一种基于图论的入侵检测方法  

An Intrusion Detection Method Based on Graph Theory

作　　者：包振[1] 何迪[1] 

机构地区：[1]上海交通大学电子工程系,上海200240

出　　处：《上海交通大学学报》2010年第9期1176-1180,1186,共6页Journal of Shanghai Jiaotong University

基　　金：国家自然科学基金项目(60802058);教育部留学回国人员科研启动基金项目

摘　　要：在入侵检测系统中引入图论的相关理论并提出了一种基于图论的入侵检测方法,将数据对象之间相似度的关系转换到图论的邻接矩阵中,再将邻接矩阵转换为关联矩阵,以表示数据对象之间的相似关系.利用最速下降法求得最佳的转换矩阵,以完成关联矩阵的块对角矩阵转换而达到数据聚类效果和鉴别出正常数据与入侵攻击数据的类别.同时,利用KDD CUP 1999数据集对系统进行仿真.结果表明,所提出的入侵检测方法能够在很低误警率的情况下达到比模糊C均值聚类算法更高的检测率.An intrusion detection method based on graph theory was proposed.The method introduced the idea of graph theory into intrusion detection system.By transferring the similarity relationship between data objects into the adjacency matrix in the graph,and transferring the adjacency matrix into an association matrix,it could reflect the relationships between data objects clearly.The steepest descent method was used to calculate the optimal transition matrix,and obtain the result of data clustering by transferring the association matrix into a block diagonal matrix,which could identify clusters of normal data and intrusion data.Meanwhile,KDD CUP 1999 dataset was used to simulate.The result shows that the proposed method has a higher detection probability under the condition of low constant false alarm rate compared with fuzzy C-means clustering algorithm.

关 键 词：入侵检测 图论 聚类 最速下降法 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]