【摘要】 入侵检测是计算机系统安全技术的重要组成部分,是计算机领域当前研究热点之一。提出了一种用于入侵检测的时间序列模型。对于计算机系统运行的某一时段,用前K次审计时事件发生次数的均值作为第K+1次的期望值,然后求期望值和第K+1次的实际次数的相对误差。当相对误差超过某一阈值时,则认为在第K+1次发生了入侵。通过仿真揭示了阈值的选择规律。仿真结果证明,在突然发生较多的入侵事件时,模型工作良好。更多还原

【Abstract】 Intrusion detection is an important part of computer security. It is a research hotspot. A time-based sequence model applying to intrusion detection is brought forward. In some period of time of a running computer system, mean value of an event’s frequency in k audits is taken as expected value at k+1th audit. Relative error of the expected value and real value at k+1th audit is computed. If the relative error is bigger than some set threshold, an intrusion occurs at K+1th audit. Simulation results open out how to select threshold. If a large amount of intrusion events appear in a short time, the model works effectively.更多还原