【作者】 刘燕；

【导师】 姜建国；

【作者基本信息】 西安电子科技大学 ， 计算机应用技术， 2007， 硕士

【摘要】 入侵检测作为一种主动的信息安全保障措施,有效地弥补了传统安全保护机制所不能解决的问题,但是面对不断增大的网络流量、日益更新的网络设施和层出不穷的攻击方式,传统的入侵检测技术存在许多不足。将数据挖掘与入侵检测技术相结合,使得入侵检测系统具有自学习的功能,增强入侵检测系统对海量数据的处理能力,得到数据中潜在的规则,增强入侵检测系统的检测功能,减轻管理人员的负担,具有较高的实用意义。本文研究了基于数据挖掘的入侵检测技术,分析了常用的入侵检测方法,归纳了入侵检测技术的发展方向,提出了相应的改进思路和算法,主要包括:1.提出改进的模糊C-均值(FCM)算法,解决了由尖锐边界所带来的误报警和漏报警问题,实现了对异常行为的检测。2.以提高径向基(RBF)神经网络分类能力为出发点,提出了一种基于改进的模糊聚类算法和正交最小二乘法相结合的FORBF算法,将其应用于入侵检测。通过KDD 1999入侵检测评估数据集上的仿真实验结果表明,所提出的算法大大加快了检测速度,提高了检测的效率,而且对新类型的攻击,也有一定的检测效果。更多还原

【Abstract】 As active defense technology, IDS (Intrusion Detection System) compensates the defects of traditional protection mechanism system, but in the face of rapid updated network configurations, the drastic increase of network traffic and do many new attach methods, traditional IDS has some limitations. The combination of data mining and intrusion detecting enables the intrusion detection system to have the ability of self-study and to have a better dealing with a vast amount of data as well as to enhance the detecting ability and lighten security managers’ work. The combination is practical and conforms to the trend of the development of intrusion detection system.This paper studies on the intrusion detection based on data mining, analyses the intrusion detection technology, and concludes its developing direction. The main works of this paper are summarized as follows:1. A modified fuzzy C-means algorithm is proposed in order to solve the question of sharp border effecting problem in the intrusion detection.2. A learning algorithm, called FORBF, is used in intrusion detection based on modified FCM and orthogonal least squares (OLS) with the aim at improving the classification accuracy of the RBFNN.The result of emulation examinations on KDD 1999 indicates the system indicates the detecting speed, increase the efficiency of intrusion, and can detect variety of unknown intrusions.更多还原