基于模糊数据挖掘和遗传算法的网络入侵检测技术  

Network Intrusion Detection Based on Fuzzy Data Mining and Genetic Algorithms

作　　者：王晟 赵壁芳 

机构地区：[1]富国银行 [2]ASDI公司

出　　处：《计算机测量与控制》2012年第3期660-663,共4页Computer Measurement &Control

摘　　要：文章通过开发一套新的网络入侵检测系统来证实应用模糊逻辑和遗传算法的数据挖掘技术的有效性;这个系统联合了基于模糊数据挖掘技术的异常检测和基于专家系统的滥用检测,在开发异常检测的部分时,利用模糊数据挖掘技术来从正常的行为存储模式中寻找差异,遗传算法用来调整模糊隶属函数和选择一个合适的特征集合,滥用检测部分用于寻找先前行为描述模式,这种模式很可能预示着入侵,网络的通信量和系统的审计数据被用做两个元件的输入;此系统的系统结构既支持异常检测又支持滥用检测、既适用于个人工作站又可以适用于复杂网络。We have developed a prototype intelligent intrusion detection system in order to demonstrate the effectiveness of data mining techniques that utilize fuzzy logic and genetic algorithms. This system combines both anomaly based intrusion detection using fuzzy data mining techniques and misuse detection using traditional rule--based expert system techniques, The anomaly--based components are devel- oped using fuzzy data mining techniques. They look for deviations from stored patterns of normal behavior. Genetic algorithms are used to tune the fuzzy membership functions and to select an appropriate set of features. The misuse detection components look for previously described patterns of behavior that are likely to indicate an intrusion. Both network traffic and system audit data are used as inputs for both components. This system architecture supports both anomaly detection and support for abuse detection, both for personal workstation can be applied to complex networks.

关 键 词：入侵检测系统 异常检测 滥用检测 遗传算法 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]