一种基于模式匹配与前馈式神经网络的入侵检测方法  

Intrusion detection method based on pattern matching and feed-forward neural network

作　　者：邓全才[1,2] 王春东[1,2] 常青[1,2] 

机构地区：[1]天津理工大学智能计算与软件新技术重点实验室,天津300384 [2]天津理工大学省部共建教育部计算机视觉与系统重点实验室,天津300384

出　　处：《天津理工大学学报》2010年第5期34-38,共5页Journal of Tianjin University of Technology

基　　金：天津市教委滨海双百项目(SB20080055;SB20080053)

摘　　要：提出了基于模式匹配与前馈式神经网络相结合的入侵检测模型.该模型运用分布式网络检测及分析系统HISTORY实现数据的采集,然后,对数据流进行数据结构转换预处理,并由模式匹配模块过滤掉部分已知入侵事件,减轻下一步入侵检测的负荷,从而提高入侵检测的效率和精准度.传统的单数据包检测只能检测孤立的入侵事件,而对于多数据包协同合作的入侵却显的无能为力.因此,本文入侵检测模块结合了单数据包检测和多数据包检测方法.实验结果表明:分析系统HISTORY的应用提高了数据处理的效率,多数据包检测弥补了单数据包检测中漏检的入侵事件,有效降低了入侵检测的漏检率.An intrusion detection model is proposed based on pattern matching and feed-forward neural network in this paper.In which,as a distributed network testing and analysis system,HISTORY is used to collect data.Then,the data stream is converted its＇ data structure for preprocessing.Some of the known intrusions are filtered out by pattern matching module,so that to reduce the load of the next step on intrusion detection,and the efficiency and accuracy of intrusion detection can be improved.The traditional single-packet inspection can only detect the intrusion that is an isolated incident,but is powerless for the collaborative multi-packets intrusion.Therefore,this paper combines single-packet inspection with multi-packet detection methods.The experimental results show that： the efficiency of data processing has been improved by the analysis system of HISTORY;the multi-packet inspection can remedy the shortage of the single-packet inspection;the loss detection rate is reduced effectively.

关 键 词：协议分析 模式匹配 前馈式神经网络 入侵检测 

分 类 号：TP391.22[自动化与计算机技术—计算机应用技术]