基于模拟数据集的字节频度入侵检测研究  

Simulation dataset based study on byte frequency intrusion detection

作　　者：翁广安[1] 

机构地区：[1]华中科技大学文华学院计算机系,武汉430074

出　　处：《计算机工程与应用》2014年第12期96-99,119,共5页Computer Engineering and Applications

基　　金：校级自然科学基金(No.j02005302)

摘　　要：为解决目前网络负载异常入侵检测领域缺乏有效、针对性的测试数据集的问题,提出一种基于虚拟关键字的构造模拟网络数据集的方法。并用它对基于字节频度分布的异常检测模型进行了测试分析。实验结果表明,模拟数据集提供了一种负载内容异常程度可控的测试数据集;检测阈值和网络环境的数据特性包括数据包尺寸分布情况、异常和正常访问相对于训练数据的偏离程度等有关。单包频度分布模型相比连接模型对负载数据异常程度的变动有更好的灵敏度。Nowadays there isn’t yet adequately competent test dataset for payload based network anomaly intrusion detection system. A simulation network dataset construction approach based on virtual keywords is proposed, and the byte frequency distribution based models are tested on it. Experiment results indicate that the method provides dataset with controllable abnormal degree; detection threshold depends on characteristic of dataset including packets length distribu-tion, deviation of normal/abnormal access to training data, etc. The single packet frequency distribution model is more sen-sitive to the alteration of abnormal degree of payload data than connection based model.

关 键 词：模拟数据集 字节频度分布 负载异常检测 网络入侵检测系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]