基于孤立点挖掘的异常检测研究  

Research on Anomaly Intrusion Detection Based on Outlier Mining

作　　者：李睿[1] 肖维民[1] 

机构地区：[1]安徽工业大学计算机学院,安徽马鞍山243002

出　　处：《计算机技术与发展》2009年第6期168-170,共3页Computer Technology and Development

基　　金：安徽省自然科学基金(2004kj062;2005kj070;2005kj071);安徽省教育厅青年教师资助计划(2004j9128)

摘　　要：随着网络技术的迅速发展,新类型的入侵行为层出不穷,人们迫切需要能检测出新类型入侵行为的技术。将数据挖掘与入侵检测相结合,能够增强入侵检测系统对海量数据的处理能力,使得入侵检测系统具有可扩展性和自学习能力,增强入侵检测系统的检测功能。从数据的观点来看,入侵检测本身是一个数据分析过程,在数量上远少于正常行为的入侵行为可看作孤立点。于是将数据挖掘中的孤立点挖掘技术作为一种网络安全检测手段,用来识别变种或未知入侵行为,对于改善入侵检测系统的性能有着重大的研究意义。文中着重通过对LOCL孤立点算法进行介绍,并提出改进算法,从而有效减少计算量,快速挖掘数据更新后的新孤立点,具有较高的实用价值。With the fast development of the lntemet, people urgemly on technology with the ability of discovering new types of intrusion coming out endlessly. The combination of data mining and intrusion detection can make the intrusion detection system deal with a vast amount of data and have the ability of extension and self- study as well as enhance the detecting ability. According to the point of data, intrusion detection is a process of data analysis. The invasion which is obviously less than normal action in amount can be seen as the outlier. Therefore, outlier mining is a fundamental and important field in data mining, and it can be used to identify varieties or unknown invasions as one of tools for intrusion detection, which is of great value in promoting intrusion detection system. Focuses on introducing the LOCL algorithm of outlier mining, and to bring up the improved algorithm, which can reduce the computation effectively and mining the new outliers quickly when the dates updated. This thesis has high values.

关 键 词：入侵检测 异常检测 数据挖掘 孤立点挖掘 孤立点 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]