基于D-S证据理论的入侵检测模型  

Intrusion detection model based on D-S evidence theory

作　　者：龚琼瑶[1] 丁宏[1] 孔霆[2] 

机构地区：[1]杭州电子科技大学计算机学院,杭州310018 [2]浙江警察学院实验中心,杭州310053

出　　处：《计算机工程与应用》2008年第18期113-114,123,共3页Computer Engineering and Applications

基　　金：浙江省自然科学基金(the Natural Science Foundation of Zhejiang Province of China under Grant No.Y104426);浙江省教育厅高校科研计划项目(No.20040457)

摘　　要：将数据融合理论引入到入侵检测过程,提出基于数据融合的入侵检测系统模型,并在系统模型的实现过程中应用了多A-gent技术,使整个模型具有良好的扩展性。在聚类、合并、关联的数据融合过程中应用了D-S证据理论,在一定程度上解决当前入侵检测系统中存在的告警洪流、误报率高、告警之间的关联性差等问题,提高了分布式入侵检测系统的检测性能。This article introduces the data fusion theory into the intrusion detection process,proposes an intrusion detection system model hased on the data fusion,and has applied the multi- Agent technology in the system model realization process.enable the entire model having the good extension.In the data fusion process of clustering,merging and associating this article applies the D-S evidence theory,solves the problems of warning onrush,high false reporting rate,inferior question hetween the warning association which existed in the current intrusion detection system,enhances the detection performance of the distributing intrusion detection system.

关 键 词：入侵检测系统 数据融合 D—S证据理论 AGENT 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]