基于粗糙集和证据推理的网络入侵检测模型  

Network Intrusion Detection Model Based on Rough Set and Evidence Theory

作　　者：叶清[1] 陈亚莎[2] 黄高峰[1] 

机构地区：[1]海军工程大学电子工程学院,武汉430033 [2]北京工业大学计算机科学与技术学院,北京100124

出　　处：《计算机工程》2011年第5期164-166,共3页Computer Engineering

摘　　要：证据推理依赖于专家知识提供证据,要求各证据体相互独立,因此难以应用于实际。针对上述问题,提出基于粗糙集理论的证据获取和基本概率赋值客观确定方法,利用粗糙集中的属性约简算法剔除冗余属性,形成最简属性集,以提高证据合成效率,缩短证据合成时间,减少证据合成的冲突现象。在此基础上建立一个基于粗糙集和证据推理的网络入侵检测模型,通过算例验证该模型检测精度较高、误检率较低。Evidence theory relies on expert knowledge to provide evidences and require evidences independent,which makes it hard to be applied.To solve the problem,this paper proposes a hybrid approach based on rough set theory and evidence theory.In order to obtain Basic Probability Assignment（BPA） for all evidences,a method of getting evidences and objective BPA based on rough set theory is presented to decrease the combination computation and improve the combination efficiency.Conflict evidences are reduced by applying the attribute simplification algorithm of rough set theory to eliminate redundant evidences.A model for network intrusion detection based on rough set theory and evidence theory is provided to show that the hybrid model has high detection precision and low false positive detection rate.

关 键 词：入侵检测 粗糙集 证据推理 基本概率赋值 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]