决策树算法在入侵检测中的应用精选.docVIP

编号： 毕 业 （学位） 论 文 （ 2009届本科） 题 目： 决策树算法在入侵检测中的应用 系(部)院： 计算机系 专 业： 计算机科学与技术 作者姓名： 指导教师： 完成日期： 2009 年 3 月 25 日  决策树算法在入侵检测中的应用 Application of Decision Tree Algorithm in Intrusion Detection 摘 要 随着网络的不断发展，安全问题越来越多，原有的防火墙已经难以单独保障网络的安全，入侵检测系统(Intrusion Detection System)开始发挥出很大的作用。当前大多数入侵检测产品使用的多是基于规则的简单模式匹配技术，它们存在着资源消耗量大，误报率高以及随着网速的提高而出现丢包等问题。为了提高检测效率和降低误报率，本论文提出了一种基于决策树的协议分析入侵检测系统。应用了协议分析技术，根据协议的高度规则性，将检测空间降低为单个的域以减少搜索空间提高检测效率；同时利用决策树能生成模型并具有预测能力的特点，用决策树算法进行检测模型的构建；将决策树算法和协议分析技术有机地结合起来，用于入侵检测。本文研究了协议分析中比较前沿的应用层协议分析方法，利用决策树构建入侵检测决策树模型，并通过将捕获的网络数据在入侵检测决策树上进行遍历来实现入侵检测。最后通过实验证明系统具有较高的检测率和可用性。 关键词：入侵检测系统，协议分析，决策树，网络安全 Abstract As the network continues to develop, more and more security issues, the original has been difficult to separate the firewall to protect network security, intrusion detection system (Intrusion Detection System) started to play an irreplaceable role。At present the majority of intrusion detection products are used in a simple rule-based pattern matching technology, the existence of their consumption of resources, In order to improve efficiency and reduce the false positive detection rate, this paper proposes a decision tree-based intrusion detection system protocol analysis。Application of the protocol analysis technology, in accordance with the rules of a high degree of agreement will be reduced to a single detection of the space domain in order to reduce the search space to improve detection efficiency；At the same time, the use of decision tree model can be generated with the characteristics of predictive capability, using decision tree algorithm to detect model Construction； the decision tree algorithm and protocol analysis techniques combine for intrusion detection。In this paper, the more cutting-edge protocol analysis of the application layer protocol analysis, intrusion detection using decision trees to build the decision tree model, as well as thro