【摘要】 提出了一种利用模式挖掘技术进行网络入侵防范的方法及其入侵检测系统模型,设计并实现了一个基于关联规则的增量式模式挖掘算法。通过对网络数据包的分析,挖掘出网络系统中频繁发生的行为模式,并运用模式相似度比较对系统的行为进行检测,进而自动建立异常和误用行为的模式库。实验结果证明,本文提出的方法与现有的入侵检测方法相比,具有更好的环境适应性和数据协同分析能力,相应的入侵检测系统具有更高的智能性和扩展性。更多还原

【Abstract】 An efficient profile mining model based on distributed system is proposed, which is used in the intrusion detecting systems. By analysis of network traffic (packets), frequent user behavior profiles are mined, and then by comparing the profile similarity, system behavior can be detected in real-time. Meanwhile, anomaly and misuse behavior profile base can be build automatically as well. Compared with most existing intrusion detection methods, our method is more adaptive, cooperative and the corresponding system is more extensible, intelligent.更多还原