基于数据挖掘的入侵检测系统研究  

Research on Intrusion Detection System Based on Data Mining

作　　者：康莉[1,2] 胡燕[1] 

机构地区：[1]武汉理工大学计算机科学与技术学院,湖北武汉430070 [2]洛阳理工学院电气工程与自动化系,河南洛阳471023

出　　处：《洛阳理工学院学报（自然科学版）》2009年第2期56-59,80,共5页Journal of Luoyang Institute of Science and Technology：Natural Science Edition

摘　　要：针对传统入侵检测系统存在的问题,提出将数据挖掘技术应用到入侵检测系统中,分析了常用于入侵检测技术中的数据挖掘方法,并将关联分析与分类分析应用到基于主机日志的异常检测中,对数据挖掘算法和如何将数据挖掘算法应用到入侵检测系统进行了研究。实现了一个基于主机日志数据的挖掘模块,通过对IIS日志文件的挖掘,生成访问异常关联规则,为入侵检测系统服务。In order to solve problems existing in traditional intrusion detection systems, this paper puts forward the application of data mining technology in intrusion detection while analyzing recent main data mining methods, and applying the Association and Classification pattern mining into host logs based anomaly detection. Data mining algorithms and its application in intrusion detection are also researched. We implement a data mining module based on the logs of host. The mining that comes from IIS logs file generates anomaly access rules that serves for the IDS.

关 键 词：入侵检测 数据挖掘 主机日志 关联规则 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]