【作者】 孟中楼；

【导师】 李庆华；

【作者基本信息】 华中科技大学 ， 计算机应用技术， 2004， 硕士

【摘要】 基于数据挖掘的入侵检测技术是当前网络安全研究的一个热点。基于数据挖掘的入侵检测系统面临的很重要的问题就是如何生成和使用数据集,即如何生成和使用训练数据集和测试数据集。在基于数据挖掘的入侵检测系统中,其特征模式库是通过对训练数据集进行数据挖掘建立起来的。训练数据集质量的高低直接影响特征模式库的质量,从而影响入侵检测系统的检测效果。准确地评测一个入侵检测系统对使用者和开发者都是很有意义的,它可以提供使用者一个选择入侵检测系统的标准;也可以作为开发者辅助开发和调试的工具。一个良好的测试数据集对于系统评测的影响是不言而喻的。但是由于具体环境和各个开发系统的巨大差异,目前这两个方面的研究都还只是初步性的,没有形成行业规范。网络中的流量数据被分为正常数据和攻击数据两个部分。首先假定一个正常网络中的流量数据是正常数据,对它们进行截获以作为正常数据;然后按照一定的方法模拟攻击行为,生成攻击数据;接着按照一定的比例混合构成混合数据。数据集生成以后再根据具体使用的入侵检测算法确定数据属性项,以转换成格式化的记录数据。按一定的比例和方法选取数据集中适当的数据项作训练数据集,并对其进行优化,去除噪音和非典型数据。优化方法采用的是k-NN的改近算法k-NN for IDS。这样生成的训练数据集可以随时添加新的数据量,易于扩充,并且能较好的接近现实环境。测试数据集的生成基本和训练数据集的生成方法相同,但其数据项可以直接从混合数据中选取而得到。由于具体网络环境等的限制,很多攻击可能很难在具体的网络中实现。分段混合评测根据不同阶段评测的重点采取离线和在线评测数据结合的方法,可以减实际环境对评测的限制。更多还原

【Abstract】 The technique of intrusion detection based on data mining is a hot research to network security. The very important thing to intrusion detection based on data mining are methodology for building and using dataset, i. e. training dataset and testing dataset. The pattern set of IDS are built on training dataset by data mining. The quality of training dataset directly affect the quality of pattern set, and so it affect the efficiency of detection. It’s significative on testing a IDS accurately, for it could provided a choice standard for user and a debugging tool for developer. The effect of a good testing dataset to system testing is obvious. Unfortunately, the research on these two fields are only pilot study and it doesn’t form the industry guild by far for varity of realistic environment and development system. The data of network traffic will be divided into normal data and attack data. It suppose that the traffic data on a normal network are normal data, so the data on normal network should be captured as normal data. The attack data would be producted by simulating attack behavious in some means. Then the normal data and the attack data would be mixed in a definite proportion to product mixture data. After dataset was producted, it should be transformed to formated dataset with some specific attributes which are chosen according to the given intrusion detection algorithm. Some data should be chosen from the dataset by some proportion and method to form trainning dataset. Training dataset should be optimized by wiping off noisy and atypical data. A methodology called k-NN for IDS is provided, which is a mended algorithm of k-NN, to optimize the dataset. This trainning dataset could be added and expanded easily and it’s also more resemble to realistic environment. The testing dataset could be generate in the same way of training dataset, but its data records could be chosen directly from those mixed data. With the limitation of realistic network environment, some attacks couldn’t be lunched in specific network. Staged-Mixed-Test can reduce the limitation of realistic network environment to intrusion detection system which utilize the online or offline dataset in different phase according to its cooresponding emphases.更多还原