基于增量决策树的快速IDS研究与实现  

Study and implementation of fast IDS based on algorithm of increment decision-making tree.

作　　者：刘波[1] 梁活民[1] 

机构地区：[1]华南师范大学计算机学院,广州510631

出　　处：《计算机工程与应用》2008年第7期141-143,248,共4页Computer Engineering and Applications

基　　金：粤港澳关键领域重点突破项目(No.2005A10307007)

摘　　要：随着攻击的日益增多和高速网络的普及,对IDS的性能要求也日益提高,Kruegel将ID3决策树引入到入侵检测系统中,有效地提高了入侵检测的速度,但该方法在增加规则时需要完全重建决策树,而且占用内存过大,对于要求实时性的应用场合并不适合。引入基于增量学习的ID5R决策树算法,并对规则属性处理方式进行优化,在保证检测速度的同时解决了实时增加规则和占用内存过大的问题。With increase of cyber attack incident and popularization of high speed network,the performance of IDS must be improved.Kruegel applied the ID3 algorithm based on decision-making tree to IDS,which can effectively improve the processing speed of intrusion detection.However,with this method a new decision-making tree must be built each time when rules are appended.Furthermore,it requires too much memory.So it is unfit for real-time applications.In this paper the author introduces the IDSR decision-making tree algorithm based on increment learning and optimize processing of rule attributes to overcome the problems.

关 键 词：入侵检测 增量学习 决策树 ID5R 网络安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]