基于数据流挖掘技术的入侵检测模型与算法  

An intrusion detection model based on data mining over data

作　　者：毛伊敏[1,2] 杨路明[1] 陈志刚[1] 刘立新[1] 

机构地区：[1]中南大学信息科学与工程学院,湖南长沙410083 [2]江西理工大学应用科学学院,江西赣州341000

出　　处：《中南大学学报（自然科学版）》2011年第9期2720-2728,共9页Journal of Central South University:Science and Technology

基　　金：国家自然科学基金面上资助项目(60873082)

摘　　要：针对目前基于数据流关联规则挖掘技术的入侵检测系统响应速度不够快和检测精度不够高的问题,提出一个基于数据流最大频繁模式的入侵检测系统模型MMFIID-DS;设计各种剪枝策略,挖掘经过训练学习后的正常数据集、异常数据集和当前检测数据流的最大频繁项集,建立系统的正常行为模式、异常行为模式和用户行为模式,达到极大缩小搜索空间的目的,提高系统的响应速度;结合误用检测和异常检测2种入侵检测方法进行实时在线检测入侵,提高系统的检测精度。理论与实验结果表明:MMFIID-DS入侵检测系统具有较好的性能。Aiming at the current problems of inadequacy in intrusion-detection system response speed and detecting precision of data mining techniques based on association rules of data streams,an intrusion detection system model of MMFIID-DS based on maximal frequent pattern of data streams was proposed.A variety of pruning strategies were proposed to mine the maximal frequent itemsets on trained normal data set,abnormal data set and current data streams to establish normal and abnormal behavior pattern as well as user behavior pattern of the system in order to improve response speed of the system by greatly reducing search space.Besides,misuse detection and anomaly detection techniques were combined to implement online real-time intrusion detection and improve detection precision of the system.Both theoretical and experimental results indicate that the MMFIID-DS intrusion detection system is fairly sound in performance.

关 键 词：数据流 最大频繁项集 异常检测 误用检测 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]