入侵检测规则动态生成研究.pdfVIP

北京交通大学学报 Vo l. 32 No.5 第 32 卷第5 期 JOURNAL OF IlF:UING JIAOTONG UNIVERSITY Oct. 2008 2ω8 主且且 文章编号: 1673-0291 (2008)05-0116-05 入侵检测规则动态生成研究 廖年冬，田盛丰 (北京交通大学计算机与信息技术学院，北京 10∞44) 摘 要:在入侵检测研究领域中，提高检测模型的检测率并降低误报率是一个重要的研究课题.本文 提出了一种针对网络入侵检测事务流的实时动态规则生成方法.该方法解决了当前主流关联规则生 成算法应用到入侵检测过程中存在的多遍扫描、大量无效规则和频繁集产生等问题.实验结果表明， 文中所提出的方法在规则动态生成和对网络异常情况的检测方面都显示出比较好的性能，相对 5nort 入侵检测系统，平均提高 10%左右的检测精度，克服了 5nort 系统在异常检测方面的局部缺陷. 关键词:规则生成;入侵检测;关联规则;FP-Tree 算法 中图分类号: TP301.6 文献标志码:A Research of the Dynamical Rule Generation for Intrusion Detection System LIAO Niandong , TIAN Shengfeng (Sch∞1 of Computer and Information Technology , 8eijing Jiωtong University , 8eijing 1ω例4 ， China) Abstract: In the research of the network intrusion detection ,it is an important topic to improve detec- tion rate and reduce false positive rate. In this paper , a novel real-time and dynamical rule genération method for network íntrusion detection stream was proposed. This method solves a number of problems of the popular association rules extraction method that exist in applying association rules algorithm to the intrusion detection: multi-scan;a lot of useless rules; a lot of unwanted frequent sets. Experimental results have demonstrated the good performance between buìldìng effìcacious rules and detecting the abnormal attack events. Comparing the detecting accuracy and the det配ting anomaly attack events with the 5nort intrusion detection system , It can improve 10% or so averagely and overcome the shortage of the detecting anomaly event of the 5nort system. Key wonls: rule generatìon; ìn