【作者】 李建；

【导师】 李杰；

【作者基本信息】 中南大学 ， 计算机科学与技术， 2011， 硕士

【摘要】 随着网络技术及网络应用的不断发展,对入侵检测系统的实时性和智能化提出了更高的要求。通过将数据挖掘技术应用到入侵检测技术中,能提高对网络数据的处理能力,进而达到提高入侵检测系统实时性和智能化的要求。本文将聚类分析和关联规则技术应用到入侵检测系统中。通过采用一种改进的对隶属度加权方式,改进了FCM聚类算法对聚类中心的更新,使得聚类算法的聚类效果更好,并能减少聚类算法的迭代次数,降低算法的时间复杂度。通过采用一种确定聚类数目和初始聚类中心的方法,得出了合适的聚类数目和初始聚类中心,使得FCM算法能在一定程度上避免陷入局部最优状态并降低了聚类数目和初始聚类中心对FCM算法的影响。通过采用一种改进的树型存储结构改进了Apriori算法中的事务的存储方式,减少了算法对数据库扫描的次数,并能减少对无用事务的扫描。通过使用一种改进的散技术生成2-频繁项集,减少了算法生成2-频繁项集的时间,从而减小了Apriori算法的时间复杂度。通过采用一种基于改进的模糊聚类分析和关联规则的入侵检测模块,改进了关联规则对聚类结果的修正方式,减少了关联规则对聚类结果的误判,从而提高了入侵检测系统的检测率降低了其误检率。更多还原

【Abstract】 As the continuous development of the network technology and the network applications, real-time and intelligence requirements become more and more important in intrusion detection system. Through data mining techniques can improve the processing power of network data,so it come impove to the real-time and intelligent requirements of the intrusion detection system. This article propose an intrusion etection systems based on cluster analysis and association rule.By using an improved method of weighted the membership of the network data, improved the way of update the cluster center of FCM clustering algorithm.So,it can cluster better, and reduce the number of iterations of clustering algorithms, also, reduces The time complexity of the FCM algorithm. Determined the number of clusters and initialcluster centers by use a simple clustering algorithms, it can avoid the FCM algorithm falling into local optimum, also can reduce the affect of clustering numbers and the initial cluster centers on the FCM algorithm.By using an improved Tree-storage structures improved the storage structures of transaction of the Apriori algorithm, reducing the times of scanning the database, and the uselessaffairs. Through using an improved Hash technique to generate 2-frequent item sets, it can reduce the time of generate 2-frequent item sets, thus reduce the time complexity of Apriori algorithm.By using an intrusion detection module based on improved FCM and association analysis, improved the way of correct the resulut of clustering by association rules,it can reduce the times of misjudging the clustering result by association rules.so it can improve detection rate of the intrusion detection system reduced its false detection rate.更多还原