基于局部参数模型共享的分布式入侵检测系统  

Distributed intrusion detection system based on shared local parameter model

作　　者：庄夏[1] ZHUANG Xia(Research Department, Civil Aviation Flight University of China, Guanghan 618307,China)

机构地区：[1]中国民航飞行学院科研处,四川广汉618307

出　　处：《计算机工程与设计》2017年第11期2935-2939,共5页Computer Engineering and Design

基　　金：国家自然科学基金民航联合基金重点项目(U1233202/F01)

摘　　要：针对现有网络入侵检测系统(IDS)不能应对网络环境频繁变化的问题,提出一种基于局部参数模型共享的分布式网络IDS。在每个节点上根据网络连接数据,使用高斯混合模型(GMM)构建弱分类器,利用在线Adaboost算法对其进行优化,形成强分类器;将该节点上的GMM参数和强分类器参数组建成一个局部参数模型,并共享到其它节点;节点利用粒子群优化(PSO)寻找来自其它节点的最优局部参数模型,结合自身训练数据构建一个支持向量机(SVM)分类器,以此作为最终的全局检测器。实验结果表明,该IDS具有较高的检测率。To solve the problem that the current network intrusion detection system（IDS）fails to cope with the frequent changes of the network environment,a distributed network IDS based on local parameter model sharing was proposed.The Gauss mixture model（GMM）was used to construct the weak classifier at each node according to the network connection,and online Adaboost algorithm was used to optimize the weak classifier to form a strong classifier.The GMM parameters and the strong classifier parameters of the node were used to build a local parametric model,which was shared to other nodes.The particle swarm optimization（PSO）was applied in each node to find the optimal local model parameters from other nodes to construct a support vector machine（SVM）classifier using its own training data,which was taken as the ultimate global detector.Experimental results show that the system has higher detection rate and lower false alarm rate.

关 键 词：网络入侵检测 分布式 局部参数模型 支持向量机 粒子群优化 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]