基于粗糙加权平均单依赖估计的入侵检测算法  

Intrusion detection algorithm based on rough weightily averaged one-dependence estimators

作　　者：耿夏琛 李千目[1] 叶德忠[2] 巫忠正[2] 蒋勇[2] 

机构地区：[1]南京理工大学计算机科学与工程学院,江苏南京210094 [2]中兴通讯股份有限公司南京研发中心,江苏南京320100

出　　处：《南京理工大学学报》2017年第4期420-427,共8页Journal of Nanjing University of Science and Technology

基　　金：国家重点研发计划政府间国际科技创新合作重点专项(S2016G9070);江苏省重大研发计划社会发展项目(BE2017739);江苏省重大研发计划产业前瞻项目(BE2017100);中央高校基本科研业务费专项资金(30916015104);赛尔下一代互联网创新项目(NGII20160122);中兴通讯产学研合作论坛合作项目(2016ZTE04-11)

摘　　要：入侵检测作为网络安全的重要方向,得到了越来越多的重视,大量传统的数据挖掘算法被尝试应用到入侵检测的数据分析领域。随着网络带宽不断提升,激增的数据量和类型繁多的协议格式使得这些传统算法在入侵检测方向的应用出现了识别精度差、运行效率不高或者参数选取困难等实际问题。该文提出一种基于粗糙集理论和贝叶斯理论的粗糙加权平均单依赖估计入侵检测算法,该方法基于粗糙集理论对网络数据进行属性约简,使用加权平均单依赖估计方法进行分类,完成对网络数据的入侵检测,算法资源消耗较低且易于实现。实验证明,该方法具有较好运行效率与准确度。Intrusion detection, as an important direction of network security, is gaining more and more attentions. A large number of traditional data mining algorithms are applied to the data analysis fieldof intrusion detection. With the increasing of network bandwidth,the great increasing amount of data and the various kinds of protocol types make the applications of these traditional algorithms encounter many reality problems, such as poor accuracy, low operating efficiency, difficulties of parameter selection, etc. In this paper,we propose an intrusion detection algorithm called rough weightily averaged one-dependence estimator,which is based on the rough set theory and Bayesian theory. This algorithm uses a subtraction method based on the rough set theory to reduce the attributes of network data,and uses weightily averaged one-dependence estimators to classify the data. By combining these two methods, this algorithm can do intrusion detection with low resource consumption and easy imple-mentation. Experiment shows that the algorithm has better operating efficiency and accuracy compared with traditional algorithms.

关 键 词：入侵检测 粗糙集理论 属性约减 贝叶斯理论 粗糙加权平均单依赖估计 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]