【作者】 谷保平；

【导师】 许孝元；

【作者基本信息】 广东工业大学 ， 计算机应用技术， 2008， 硕士

【摘要】 随着计算机技术和通信技术的迅猛发展,计算机应用日趋广泛与深入,同时也使网络安全问题更加突出和复杂,它关系到商业利益、个人隐私乃至国家机密。现有的各种安全技术和产品可以保证信息系统具有一定的安全性,但由于它们自身的脆弱性,无法保证绝对的安全。因此,如何对计算机系统和网络中的各种非法行为进行主动防御和有效抑制,成为当今网络安全有待解决的重要问题。尽管广泛应用了各种传统安全产品,如识别/认证、访问控制、审计、加密、防火墙等,但由于安全系统的不完备性,计算机系统和网络仍然会遭到入侵者的攻击。因此需要进一步引入入侵检测技术。入侵检测不能阻止入侵和攻击,但它能够寻找漏洞,并在非法入侵者攻击系统时,及时将它们捕获。因此引入侵检测技术是目前保证计算机安全的必要手段。入侵检测系统是实时监视系统中的活动,检测是否有入侵发生的系统。它通过监视系统的动态特征,确定是否发生入侵。入侵检测系统是任何一个完整的网络安全系统中必不可缺的部分。目前,商用的入侵检测系统所采用的检测方法大多是基于规则的,这种基于规则的方法首先是从各种不同的审计数据流中提取特征,然后和己有的由专家提供的规则进行比较来判断入侵。这样就造成了它们只能够对某一些特定的或已知的入侵行为取得比较好的结果。尽管现在有很多采用数据挖掘和机器学习等方法来进行检测入侵的研究,这些方法能够得到比较好的检测效果也能够检测一些未知入侵。但是这些方法一般都要求训练数据集中数据样本是洁净的,或者要求数据样本是有类标的数据,而实际上,要为系统的学习收集一个洁净数据集往往不太容易,而且在网络环境中数据量是非常巨大的,用人工的方法来对其标类的代价非常高。因此寻找一个对数据集要求不高的可用的入侵检测方法对建立一个实用的入侵检测系统是至关重要的。本文就是基于上述的研究背景,开展了基于聚类技术的入侵检测的研究,以提高检测算法对未知入侵的检测有效性为目标,从检测率和误报率两个重要指标出发,将传统的K均值算法应用在入侵检测上,发现其存在的空聚类和局部最优值问题,然后提出两种改进的算法:改进的K均值算法和基于粒子群优化的K均值(PSO-K均值)算法,并进行了计算机仿真实验,实验结果证明两种改进的算法是可行的。论文综述了入侵检测的发展现状,详细介绍了己有的入侵检测的体系结构及方法,介绍并分析了传统聚类方法在入侵检测领域中的优势和不足,并将两种改进的算法用于入侵检测,对KDDCup99数据集的实验表明,提出的改进算法取得明显效果。更多还原

【Abstract】 With the rapid development of computer and communication technologies, computer applications are increasingly developing in breadth and depth, thus making computer security involved in business benefits, personal privacy and national secret more and more remarkable and complicated. Now all the existing computer security products can provide certain protection for computer and network, but they are not complete because of their own vulnerability. So how to prevent computer and network from a variety of attacks in progress actively becomes an important problem to be solved.Though the traditional security products, like identification/ authorization, access control audit, encryption and firewall etc., are widely used, the computer system and the network are still exposed to attacks because of the imperfect security system. However, the imperfect security system that we speak just means the security system having some vulnerability. Though the intrusion detection technology can’t prevent invasion and attack, it has the ability to find the vulnerability and capture it when the illegal invaders attack the system. So it is the essential means to guarantee the security of the current computer system.Intrusion detection system is a real time monitor system to supervise the invade activities, i.e., by the real time monitor system’s dynamic character. Intrusion detection can determine whether there is invasion or not. So intrusion detection systems are an integral part of any complete security network system. Currently, the most widely deployed and commercially available methods for intrusion detection employ signature-based detection. These methods extract features from various audit streams, and detect intrusions by comparing the feature values to a set of attack signatures provided by human experts. Such methods can only detect previously known intrusions since these intrusions have corresponding signatures. Hence, there came up with many approaches such as data mining and knowledge discovering to detect intrusions. However, the intrusion models that all these methods adopt totally depend on the instances of the training data sets, so clean data sets are crucial for building applied IDS. In fact, collecting clean data sets is very difficult and costly, so it is essential to study the unsupervised intrusion detection methods. Based on the research background stated above, this thesis intends to develop research on network intrusion detection based on clustering method. In order to enhance the effectiveness for unknown intrusions, some network detection algorithms mainly using clustering analysis are proposed which are measured by the detection rate and the false positive rate, and are provided with computer simulations.In this paper we propose improved k-means and the PSO-k-means algorithm which combines the k-means with PSO, after that we analyze the advantages and disadvantages of traditional clustering algorithm that applying to intrusion detection, and then introduced Particle Swarm Optimization algorithm into clustering algorithm. Through experiment to KDDCup99 datasets, the improved algorithm that this thesis brings forward gets obvious effect.更多还原