一种基于遗传算法的误用检测模型自适应建立算法  

Study of building misuse detection models based on genetic algorithms

作　　者：关健[1] 刘大昕 

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,黑龙江哈尔滨150001

出　　处：《哈尔滨工程大学学报》2004年第1期80-84,共5页Journal of Harbin Engineering University

摘　　要：传统入侵检测系统的攻击模型库需要专家手工建立,不利于系统的推广和应用.为了实现入侵检测系统中入侵特征提取和攻击规则生成的自动化,提出将遗传算法应用于入侵检测规则学习问题中.采用遗传进化操作启发式搜索网络特征数据空间,通过操作算子进行遗传运算,产生出具有高适应度的个体,从而自动归纳出某种入侵的共同属性.采用DARPA入侵检测评价计划数据库进行了仿真实验,该方法归纳总结出的攻击特征符合客观事实,与专家建立的攻击规则一致,并且较好地处理了噪音数据,具有鲁棒性.误用检测模型自适应建立算法能够在无专家参与的情况下自动建立攻击类型库,增强了入侵检测系统的可移植性.The attack model bases of traditional intrusion detection systems are manually built, hampering the popularization and application of such systems. A study was conducted to realize the automation of intrusive feature extraction and attack rule generation. An adaptive method based on genetic algorithms was presented for learning the intrusion detection rules. This method uses heuristic search in the data space of network features. The genetic operations run through some operators. The individuals with high fitness produced, and the same attributes of an intrusion are found. In the simulations and experiments the features of an attack are summarized inductively through the databases of the DAPRA Intrusion Detection Evaluation Program, and it accorded with the objectivity and attack rule summarized by research experts. This method can process the noise data with robustness. The adaptive method for building misuse detection models can automatically create the model bases of attacks and strengthen the transplantation of intrusion detection systems.

关 键 词：入侵检测系统 归纳学习 遗传算法 网络安全 攻击模型库 特征提取 攻击规则 检测模型 自适应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP18[自动化与计算机技术—计算机科学与技术]