【摘要】 针对单一技术在网络安全防御上的局限性,对入侵检测和蜜罐技术进行了认真研究。构建了一个新的入侵检测与蜜罐技术联动的防御系统。通过蜜罐收集入侵信息,用无监督聚类算法分析入侵数据,将数据集划分为不同的类别,提取新的攻击特征,扩充了入侵检测系统的特征库。通过实验分析和采用KDDCUP99入侵数据集进行测试,证明对于误报和漏报问题有一定的改进,提高了对未知入侵攻击的检测效率。更多还原

【Abstract】 For the limitations of single technology on the network security,a careful study on the Intrusion detected and Honeypot technology is conducted,and a new defense system of intrusion detected and Honeypot technology linkage is set up.By collecting intrusion information with honeypot,instrusion data is analyzed by unsupervised clustering algorithm,and the data is divided into different parts and extract new attack features to elarge the intrusion detection system features library.Experiments and KDDCUP99 data test prove that the problem of false alarm and leaking alarm are improved and the efficiency of unknown intrusion detected is increased.更多还原