基于数据挖掘的网络数据库入侵检测系统  

Research on Intrusion Detection System for Network Database based on Data Mining

作　　者：王丽娜[1] 董晓梅[1] 郭晓淳[1] 于戈[1] 

机构地区：[1]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《东北大学学报（自然科学版）》2003年第3期225-228,共4页Journal of Northeastern University(Natural Science)

基　　金：国家自然科学基金资助项目 ( 90 10 40 0 5 ;60 173 0 5 1) ;国家'八六三'高技术计划CIMS主题项目 ( 2 0 0 1AA415 2 10 )

摘　　要：提出一种基于数据挖掘的网络数据库入侵检测模型 (NDBIDS) ·讨论了NDBIDS的结构及各部件的功能·利用关联规则Apriori算法 ,对用户正常历史数据进行挖掘 ,并对产生的规则进行归并更新 ,通过训练学习生成异常检测模型 ,并利用此模型实现基于数据挖掘的异常检测·NDBIDS可以检测伪装攻击、合法用户的攻击和攻击企图三种类型的攻击 ,通过实验给出了相应攻击的检测率、假报警率、漏报率和检测正确率·本系统的建立不依赖于经验 。An intrusion detection system model for network database NDBIDS based on data mining was proposed. The framework of the intrusion detection system and the function of components were discussed. The users' normal historical data were mined by the Apriori association rule algorithm. The anomaly detection model was implemented by merging and updating the rules. Three kinds of attacks, masquerading, penetration and intrusion attemp, can be detected by NDBIDS. The corresponding detection rate, false alarm rate, missing report rate and correctness rate were computed. The construct of system does not depend on experiences, so it has good flexibility.

关 键 词：网络数据库 数据挖掘 关联规则 入侵检测 攻击 数据库安全 

分 类 号：TP311.132[自动化与计算机技术—计算机软件与理论] TP393.08[自动化与计算机技术—计算机科学与技术]