基于机器学习和数据挖掘的入侵检测技术研究（毕业学术论文设计）.docVIP

基于机器学习和数据挖掘的入侵检测技术研究 摘 要 入侵检测系统(IDS)的主要任务是依照一定的策略，对网络的运行状况进行监视，尽可能发现各种攻击行为，以保证网络系统资源的机密性、完整性和可用性。UCI KDD标准数据集上所做的大量实验显示，我们的入侵检测方法的检测能力与SVM相近，优于C4.5和简单贝叶斯分类算法(na?ve Bayes classifier)。此外，我们的入侵检测方法在各种数据集上均取得了较好的检测结果，显示出其在入侵检测领域内的诱人前景。 此外，本文还针对分布式拒绝服务攻击(DDoS)提出了一个基于序列模式挖掘(sequential pattern mining)方法的报警关联模型。通过挖掘报警序列并且对得到的序列报警模式根据其相似性进行关联，我们的报警关联系统极大的减少了报警的数量，并且能够识别DDoS入侵。实验表明，对于DDoS报警序列识别而言，我们的方法略优于传统的隐马尔科夫模型(Hidden Markov Model)。 关键词： 机器学习；数据挖掘；报警关联 Research on Intrusion Detection Techniques Based on Machine Learning and Data Mining Methods Abstract The task of an intrusion detection system (IDS) is to monitor the running of the networks according to some pre-specified policy and try to find the intrusive activities so as to protect the confidentiality, integrity and usability of the network resources. From the perspective of the triggering mechanism, intrusion detection can be categorized into anomaly detection and misuse detection. While the former detects intrusions by checking the deviation of the current activities from the established normal profiles, the latter identifies attacks by means of the degree to which current network activities match the signatures of known intrusions. For anomaly detection, the biggest shortcoming is a substantial false alarm rate. For misuse detection, its main drawback is an inherent inability to detect unknown intrusions. An IDS tend to raise a huge volume of alerts during its running, a large part of which are false alerts. This not only greatly increases the workload of post-detection analysis and decision-making, but also makes the identification of intrusions more difficult. For multiple-stage distributed network intrusions (such as DDoS), the situation is even more severe since true intrusions tend to be overwhelmed by the large amount of alerts. To attack these problems, we first propose an intrusion detection method based on the Maximum Entropy (ME) Model. ME model, a flexible probability estimation method, offers a compa