基于数据挖掘的网络入侵检测系统研究.docVIP

基于数据挖掘的网络入侵检测系统研究 Research on Network Intrusion Detection Based on Data Mining 作 者 姓 名 学 位 类 型 学 科、专 业 研 究 方 向 导 师 及 职 称 2010年月 基于数据挖掘的网络入侵检测系统研究 摘要 随着网络的不断发展，安全的重要性越来越突出，原有的防火墙已经难以单独保障网络的安全，入侵检测系统开始发挥出不可替代的作用。然而，现有的入侵检测系统在有效性、适应性和可扩展性等方面都存在不足，尤其是在遇到新的入侵类型时变的无能为力，针对这些不足，本文从数据处理的角度，用数据挖掘的方法建立了入侵检测的模型。由于入侵检测系统处理的数据含有大量的冗余与噪音特征，使得系统耗用的计算资源大，导致系统训练时间长、实时性差，检测效果不好。特征选择能够很好地消除冗余和噪音特征，有利于提高入侵检测系统的检测速度和效果，因而对基于特征选择的入侵检测系统进行研究是必要的，也符合入侵检测领域的发展趋势。 本文提出了一种基于过滤器模式特征选择的入侵检测系统模型，分别用Chi2、信息增益和FCBF三种不同的算法进行特征选择，用决策树C45作为分类算法。按照DoS，PROBE，R2L，U2R 四个类别对KDD1999数据集进行分类，并且在每一类上进行了大量的实验。实验结果表明，对每一类攻击，由本文提出的特征选择算法构建的入侵检测系统在建模时间、检测时间、检测已知攻击、检测未知攻击上，与没有运用特征选择的入侵检测系统相比具有更好的性能。 关键词：入侵检测，数据挖掘，特征选择，决策树 Research on Network Intrusion Detection Based on Data Mining Abstract With the progress of network, the importance of security is become more and more obvious, the traditional security device firewall has difficult in protecting network security alone. However, current intrusion detection systems lack effectiveness, adaptability and extensibility, and especially, they become ineffective in the face of detecting new kind of attacks. Aimed at these shortcomings, this thesis takes a data-centric view to IDS and builds an intrusion detection model by mining audit data. As the data intrusion detection system processed contains a lot of redundancy and noise characteristics causing slow training and testing process, high resource consumption as well as poor detection rate. Feature selection can eliminate redundant and noisy features well. In order to improve performances of intrusion detection system in terms of detection speed and detection rate, thus a survey of intrusion detection system based on feature selection is necessary, and also conforms to the trend in the field of intrusion detection. An intrusion detection system model based on filter-model feature selection is int