【作者】 郭慧玲；

【导师】 唐勇；

【作者基本信息】 燕山大学 ， 计算机应用技术， 2006， 硕士

【摘要】 入侵检测系统(Intrusion Detection System,IDS)作为一种主动的信息安全保障措施,有效地弥补了访问控制、防火墙等传统安全防护技术的缺陷,能有效的检测到入侵企图和入侵行为。本文以提高检测算法对未知入侵的检测有效性为目标,从检测率和误报率两个重要指标出发,提出以遗传算法和聚类分析为主线的相关检测算法,选题具有理论意义的实用价值。本论文主要研究工作如下:首先,对特征子集的选择方法进行研究,提出基于遗传算法的特征子集选择算法。此过程有利于提高检测的精确度同时降低系统的负荷。其次,将判别遗传聚类算法用于异常入侵检测,并对算法的执行策略进行相应的改进,提出基于遗传聚类的网络异常检测(Network AnomalyIntrusion Detection based on Genetic Clustering,NAIDGC)算法,省去了构造训练数据集的繁重工作量,降低了算法对初始参数的敏感性。再次,针对NAIDGC算法存在的问题和网络入侵检测的有效性问题,提出改进的基于遗传聚类的入侵检测(Intrusion Detection Based on GeneticClustering,IDBGC)算法。该算法由最近邻聚类和遗传优化两部分组成。遗传算法采用模拟退火选择算子和自适应变异算子,以增强遗传算法的局部优化性能和改进随机变异的不足。最后,本文采用通用数据库UCI KDD Database Repository的数据集和KDD CUP DATA网络数据集进行了实验。结果表明:本文所研究的三种算法都有效,其中改进的IDBGC算法对未知入侵攻击平均检测率和平均误检率保持较高水平,且具有很好的适应性和可扩展性。本文提出的应用于异常检测引擎的算法,对提高针对未知入侵的检测效率有重要的意义。更多还原

【Abstract】 Intrusion Detection System acts as the effective complement to traditionalprotection techniques such as access control, firewall. Intrusion detection isconsidered to be an effective technique to detect attacks that violate the securitypolicy of systems. It can detect the successful breaches of security as well asmonitor attempts to breach security. In this paper, in order to enhance theeffectiveness for unknown intrusion, some network detection algorithms mainlyusing genetic algorithms and clustering analysis are proposed. They aremeasured by the detection rate and the false positive rate. It has applied valueon theory.The main contributions of this dissertation are summarized as follow:Firstly, to research methods on feature subset selection, a new algorithm offeature subset selection based on the genetic algorithm was proposed. It can bepropitious to enhance detective precision and to reduce burthen of the intrusiondetection system.Secondly, distinguished genetic clustering algorithm was approached toanomaly intrusion detection. The implementation tactic was improvedaccordingly. Then the Network Anomaly Intrusion Detection based on GeneticClustering (NAIDGC) algorithm was proposed. It not only makes workload ofconstructing training data set be saved but also reduce sensitivity on initialparameters.Thirdly, improved IDBGC algorithm was proposed based on solving theproblem of the NAIDGC algorithm to enhance effectiveness of networkintrusion detection. The improved IDBGC algorithm consists of nearestneighbor clustering stage and the genetic optimization stage. Meanwhile, asimulated annealing selection operator and an adaptive mutation operator wereapplied to genetic algorithm to enhance ability of local searching and toimprove shortcomings of random mutation.Finally, experiments on the currency database UCI KDD DatabaseRepository and DARPA/Lincoln Labs data were described. These experimentsshow that these three algorithms are efficiency. The improved IDBGCalgorithm achieves good performance for the average detection rate and theaverage false positive rate. It has preferably adaptability and expansibility.The algorithms proposed in this paper approach to anomaly detectionengine. They are significant to improve efficiency of detecting unknownintrusions.更多还原