【作者】 杨晨；

【导师】 梁意文；

【作者基本信息】 武汉大学 ， 计算机软件与理论， 2019， 硕士

【摘要】 互联网发展迅速,网站增多,Web服务器的安全性愈发重要,因而对Web服务器进行入侵检测迫在眉睫。本文将构建基于误用的入侵检测算法,检测入侵行为并定位类型,做出合适的防御行为,减少入侵造成的损失。基于误用的入侵检测算法的重要功能是解决多类不平衡问题。多类不平衡样本要求分类算法能够同时处理数据量大的样本和数据量小的样本,且受不平衡比影响较小。现有该领域的分类算法均有各自的优缺点:部分机器学习算法如神经网络需要大量训练数据,处理负类样本效果差,有些算法如决策树则受类间不平衡影响较大。反向选择算法借鉴生物体胸腺T细胞阴性选择过程,通过学习自我样本的特点来区分非我样本。因其单类学习的特点,受不平衡比的影响较小,处理数据量小时有极佳的准确率,处理数据量大的样本也不会出现性能问题。但多类不平衡问题也会为反向选择算法带来检测器数量分配问题,同时要求反向选择算法能够更好地拟合边界样本,从而实现更高的检测效率。受不平衡样本处理方式的启发,本文尝试将反向选择算法用于构建Web服务器入侵检测中的误用检测算法,并进一步构建针对不平衡样本的反向选择算法以提高检测效率。首先总结入侵检测领域的特点与研究现状,分析现有方法存在的缺点。并介绍人工免疫系统及其中的反向选择算法,指出反向选择算法用于此问题的优势,并分析需要改进的地方。接着将反向选择算法用于处理不平衡问题,并提出优化方法。提出借鉴不平衡样本中代价敏感的思想,使用MetaCost方法,为反向选择算法中不同类别指定误分代价,结合先验概率,调整检测器在类间不同的分配,使检测器的数量分配更加合理,从而提高检测效率。再结合已有的克隆选择思想优化检测器分布,提高检测器对样本空间的覆盖,降低检测器重合。再提出结合Borderline-SMOTE中边界界定的方式,找出边界“危险”样本点生成检测器拟合边界,提高检测器对样本的覆盖从而提高检测准确率。最后使用KDD99网络入侵检测数据集作为实验数据集,通过设计对比实验,使用多类不平衡样本的评价指标F-Measure、G-Mean和ROC曲线及AUC值对算法进行评价,证明反向选择算法比其他经典算法更适合用于解决服务器入侵检测中的多类不平衡,而提出的代价敏感的改进方式与边界界定的方式均能够有效提高反向选择算法用于多类不平衡样本的分类效率,而综合代价敏感、边界界定和克隆选择优化的算法则拥有最高的分类效率。更多还原

【Abstract】 With the rapid development of the Internet and the growing number of websites,the security of Web server is becoming more and more important.Therefore,it is extremely urgent to conduct intrusion detection on web servers.This paper will build a misuse-based intrusion detection algorithm to detect intrusion behavior and locate the intrusion type,make appropriate defense behaviors and reduce the losses caused by intrusions.An important function of the misuse-based intrusion detection algorithm is to solve multi-class imbalanced problems.The classification algorithm needs to have good performance with both large data volumes and small data volumes for multi-class imbalanced data.And it should be less affected by the imbalance ratio.The existing classification algorithms have both merits and shortcuts in this field.For instance,some machine learning algorithms such as neural networks,which requires a large amount of training data and the capability of processing small dataset is poor;some algorithms such as decision trees are greatly affected by the imbalance between classes.Negative Selection Algorithm draws on the negative selection process of the thymus T cell in organisms,and distinguishes non-self samples by learning the characteristics of self samples.It is less affected by the imbalance ratio due to the characteristics of its single-class learning.Meanwhile,it has excellent accuracy and no performance problem when processing samples with large dataset.However,the multiclass imbalance problem also brings on the problem of quantity allocation of detector.And it requires the Negative Selection Algorithm to fit the boundary samples better to getting higher detection accuracy.Inspired by imbalanced data,this paper attempts to use Negative Selection Algorithm to construct the misuse detection algorithm for web server intrusion detection.Furthermore,improve the detection accuracy for imbalanced data by optimizing Negative Selection Algorithm.Firstly,this paper summarizes the characteristics and current research of the intrusion detection field,and analyze the shortcomings of the existing methods.It also introduces the Artificial Immune System and its Negative Selection Algorithm.Then this paper points out the superiorities of the Negative Selection Algorithm for this problem and analyzes the improvement.Secondly,this paper shows the process to use the Negative Selection Algorithm to solve the imbalance problem and proposed an optimization method.Then the MetaCost method is used to specify the misclassification cost for different classes in the Negative Selection Algorithm based on the cost-sensitive idea from imbalanced data.Combined with the prior probability,the detectors are adjusted differently among the classes to make the number of detectors more reasonable,which is used to improve the efficiency of detection.Moreover,combined with the existing clonal selection idea,the detector distribution is optimized to improve the coverage of the sample space and reduce the overlap between detectors.Then,this paper finds out the “dangerous” samples in the boundaries to generate detectors to fitting boundary,which learn from the boundary definition in Borderline-SMOTE,to improve the coverage and accuracy of detection.Finally,the KDD99 network intrusion detection dataset was used as the experimental dataset.The evaluation indexes F-Measure,G-Mean and ROC curves and AUC value of multi-class imbalanced samples are used to evaluate the algorithm through the comparative experiment.And it is proved that the Negative Selection Algorithm is more suitable than other classical algorithms in solve the multi-class imbalance in server intrusion detection.The proposed cost-sensitive method and boundary definition method can effectively improve the classification efficiency of Negative Selection Algorithm for multi-class unbalanced samples.And algorithms that combine cost-sensitive,boundary-defined,and clonal selection optimization have the highest classification efficiency.更多还原