一种基于二层贝叶斯网的网络入侵检测方法  

Network Intrusion Detection Based on Two-layer Bayesian Network

作　　者：程传慧[1] 郑秋华[2] 

机构地区：[1]中南财经政法大学信息学院,武汉430070 [2]杭州电子科技大学计算机学院,杭州310018

出　　处：《武汉理工大学学报（交通科学与工程版）》2010年第1期171-174,共4页Journal of Wuhan University of Technology（Transportation Science & Engineering）

基　　金：湖北省自然科学基金项目资助(批准号:2009CDB103)

摘　　要：提出了一种基于二层贝叶斯网的网络入侵检测方法,该方法能够从审计数据中自动学习知识生成入侵模型,并根据该模型检测入侵行为,从而提高入侵检测系统得自适应性和可移植性,降低系统的误报率和误检率.并通过设计实验来验证基于贝叶斯网的入侵检测系统的性能,实验数据采用KDD cup 1999年的部分数据.实验结果表明:该方法在只使用10%训练数据和部分记录属性来学习的情况下,检测效果仍比较好.In this paper we present a method of using two-layer Bayesian network in intrusion deteetion. Such method can detect intrusions using the model, which is constructed by learning from audit data, thus, the ability of adapting and porting of the intrusion detection system can be enhanced and the false alarm rate can be reduced. Experiments were designed to test the performance of Bayesian network in intrusion detection. The experiment data are from KDD competition 1999 by DARPA. The result of the experiment shows that this model performs well while using only 10% of the KDD training data randomly sampled from the entire training data set and part of attributes in each record.

关 键 词：二层贝叶斯网 网络入侵检测 不确定性推理 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]