弱关联规则下的联合数据库入侵检测方法研究  

Research of Federated Database Intrusion Detection Methods Based on Weak Association Rules

作　　者：王世运[1] 

机构地区：[1]琼州学院电子信息工程学院,海南三亚572022

出　　处：《科技通报》2015年第3期184-187,共4页Bulletin of Science and Technology

基　　金：琼州学院校级青年科学基金项目:(QYQN201338)

摘　　要：联合数据库的入侵和普通入侵不同,其无显著的行为特征,入侵数据属性差异较大,很难形成统一的约束规范,导致传统的入侵检测方法,由于通过提取入侵行为特征进行入侵检测,无法有效且准确地完成联合数据库的入侵检测,提出一种弱关联规则下的联合数据库入侵检测方法,通过弱关联模式在联合数据库中支持程度与联合数据库记录总量的比求出弱关联模式的支持度,获取频繁弱关联模式集,采用改进的双置信度算法对频繁弱关联模式集的置信度进行计算,获取弱关联规则,依据弱关联规则,通过原始联合数据库对分类超平面进行计算,采用该超平面完成联合数据库的整体分类,采用主成分分析方法对联合数据库中的操作数据进行降维处理,通过差异分类方法,对联合数据库中的操作数据特征进行分类操作,实现弱关联规则下联合数据库的有效入侵检测。实验表明,所提方法具有很高的准确性及有效性。Invasion of different joint database intrusion and ordinary, no significant behavioralcharacteristics of the intrusion data attributes are different, it is difficult to form a unified constraintspecification, lead to the traditional intrusion detection methods, due to the intrusion detection by extractintrusion behavior characteristics, unable to effectively and accurately complete federated databaseintrusion detection, proposes a weak association rules under the joint database intrusion detectionmethod, through the weak correlation patterns in the federated database support and joint databaserecords of the total than the support of weak correlation patterns, frequent weak correlation patterns wereobtained, with the improved algorithm of double degree of confidence the confidence level of frequentweak correlation patterns set calculation, get weak association rules, on the basis of weak associationrules, using the original database to the classification hyperplane calculated, using the overallclassification hyperplane complete joint database, USES the principal components analysis method forjoint operations in the database data dimension reduction processing, through different classificationmethod, classified characteristics of joint operation data in the database operation, implement unitedunder weak association rule database intrusion detection effectively. Experiments show that the proposedmethod has high accuracy and effectiveness.

关 键 词：弱关联规则 联合数据 入侵检测 

分 类 号：TP122[自动化与计算机技术—控制理论与控制工程]