贝叶斯树算法在异常入侵检测中的应用  

Application of Bayesian Tree Algorithm to Anomaly Intrusion Detection

作　　者：李永忠[1] 赵博[1] 杨鸽[1] 徐静[1] 

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003

出　　处：《江苏科技大学学报（自然科学版）》2008年第1期52-56,共5页Journal of Jiangsu University of Science and Technology:Natural Science Edition

基　　金：江苏省教育厅;江苏科技大学资助项目(2005DX006J)

摘　　要：研究了Windows平台下异常检测方法,提出了一种利用Windows Native API调用序列和基于贝叶斯树算法的主机服务进程规则与对应概率分布生成算法。根据长为N-1的Windows Native API调用序列预测第N个调用的概率分布,对生成的概率序列用U检验方法作为异常检测算法。以贝叶斯树作为弱分类算法,利用AdaBoost-M1方法构造多个基于贝叶斯树的概率分布序列,并按一定方式把它们组合成一个加强的概率分布序列进行入侵检测。实验结果表明这种方法能明显提高模型预测能力。The anomaly intrusion detection algorithm on Windows platform is studied. With the Windows Native API sequence,a host process rule and the corresponding probability distribution are presented as a normal model based on the Bayesian tree algorithm. With the test sequence,the probability distribution of the nth native API from the preceding N- 1 native API is predicted by using the U-test method for the anomaly intrusion detection algorithm. Moreover, the AdaBoost-Ml algorithm is used to construct a series of probability distribution sequences based on the Bayesian tree algorithm. At last, a final probability distribution based on the boosted combination of the probability distribution sequences is formed,which can be applied to the intrusion detection. Experi- ment results proved a good prediction performance with this model.

关 键 词：入侵检测 Windows NATIVE API 贝叶斯树 AdaBoost—M1 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]