遗传算法在入侵检测规则提取中的应用  

Application of genetic algorithm in rule extraction of intrusion detection

作　　者：郭慧玲[1] 唐勇[2] 张冬丽[2] 

机构地区：[1]中国环境管理干部学院信息工程系,河北秦皇岛066004 [2]燕山大学信息科学与工程学院,河北秦皇岛066004

出　　处：《哈尔滨工业大学学报》2009年第1期248-250,共3页Journal of Harbin Institute of Technology

基　　金：国家自然科学基金资助项目(60374042)

摘　　要：传统入侵检测系统的攻击规则库需要专家手工建立,为了实现入侵检测系统中攻击规则生成的自动化,提出将遗传算法应用于入侵检测规则学习问题中.遗传算法依据网络审计记录推导出分类规则,用支持度-置信度函数作为适应度函数进行规则评估,产生的规则用于实时环境中的检测或分类网络入侵.最后通过入侵实例验证了方法的有效性.The attack rule base of traditional intrusion detection systems were built manually. An adaptive method based on genetic algorithms was presented for learning the intrusion detection rules in order to realize the automation of attack rule generation. The genetic algorithm was employed to derive a set of classification rules from network audit data, and the support-confidence framework was utilized as fitness function to judge the quality of each rule. The generated rules were then used to detect or classify network intrusions in a realtime environment. The experiment proves the efficiency of the presented method.

关 键 词：入侵检测 误用检测 遗传算法 规则提取 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]