一种快速检测入侵的方法  

A Fast Method for Detecting Intrusion

作　　者：韩仲祥[1] 史浩山[1] 董淑福[2] 余征[2] 

机构地区：[1]西北工业大学电子信息学院,陕西西安710072 [2]空军工程大学电讯工程学院,陕西西安710077

出　　处：《空军工程大学学报（自然科学版）》2008年第1期54-57,共4页Journal of Air Force Engineering University(Natural Science Edition)

基　　金：教育部博士点基金资助项目(20050699037);陕西省自然科学基金资助项目(2006F16)

摘　　要：研究了网络入侵检测的最优检测问题。针对攻击事件类型和规则的匹配问题,改进了限定条件下规则集的选取,通过建立凸松弛函数,确定问题的最佳解,最后通过模拟实验,验证了用最佳解匹配攻击数据包,效果明显优于BM方法。Most papers on detection intrusion problems made by past researchers usually employ rule portfolio to match attack data packages and appear unable to keep the system in optimized detection status when the detection probability is unknown or vaI3~ing. In this paper, the method of rule portfolio election is improved and the optimal solution via establishing convex relaxation function is gained, then attack package is matched with it. Finally simulation is done with computer, which shows that the effect is better than that of the BM method.

关 键 词：入侵检测 规则集 匹配 凸松弛函数 

分 类 号：TN95[电子电信—信号与信息处理]