模式识别方法在入侵检测中的应用  

Intrusion detection using pattern recognition methods

作　　者：姜楠[1] 

机构地区：[1]天津大学计算机科学与技术学院,天津300072

出　　处：《电子技术应用》2007年第10期151-153,157,共4页Application of Electronic Technique

摘　　要：将模式识别方法应用到入侵检测领域,用以区分正常和异常的用户或主机行为。采用KDD99作为实验数据集,通过计算信息增益,从原始数据中选取对分类结果影响较大的特征属性;再分别选取两种带监督的模式识别方法支持向量机(SVM)和多层神经网络(MNN)以及两种不带监督的聚类方法Single-Linkage和K-Means进行实验。实验结果表明,上述方法在入侵检测领域中具有很好的应用前景。This paper applied pattern recognition techniques to the intrusion detection field to detect abnormal user or host behaviors. On KDD99 data set, the information gain measurement had been used to select the related features. Two supervised methods, SVM （Support Vector Machine） as well as MNN （Multi-layer Neural Network）, and two unsupervised methods, Single- Linkage and K-Means had been implemented and evaluated. The results showed that those methods above have demonstrated good detection rate and low false positive rate, which is promising in intrusion detection field.

关 键 词：模式识别 入侵检测 支持向量机 聚类 

分 类 号：TP391.4[自动化与计算机技术—计算机应用技术]