基于prefixspan算法的计算机入侵检测研究-模式识别与智能系统专业论文.docxVIP

摘 摘 要 计算机入侵检测技术是近年来计算机网络安全领域的重要方向。本文首先介 绍了防火墙和入侵检测系统的技术发展。入侵检测是计算机内部网中位于防火墙 之后的安全防护工具，是一种积极主动检测攻击的方法。由于入侵检钡4系统是网 络安全防护中的最后一道屏障，其在系统安全方面的作用和重要性也就显得格外 重要。入侵检测按检测方式可以分为误用检测和异常检测。目前的异常检测方法 有统计方法、神经网络、数据挖掘等。数据挖掘是近年来兴起的一种数据库中知 识发现的技术(KDD，Knowledge Discover in Database)，在挖掘海量数据中的 有用知识中性能强大。本文介绍了上述几种异常检测算法，并对他们的优缺点进 行了比较论述。详细介绍了数据挖掘技术在入侵检测系统中的应用，并将其中的 序列模式分析算法应用在异常检测技术之中。文中对目前主要的三种序列模式分 析方法进行了比较分析。改进了其中性能晟好的PrefixSpan算法，提高了其挖掘 速度，降低了算法运行的内存损耗，将改进后的算法应用到入侵检测中的异常检 测技术中，并采用网络连接审计记录进行了实验数据仿真，给出了结果分析和未 来技术发展的展望。 关键词 数据挖掘： 入侵检测； 异常检测； 误用检测： 频繁序列 AbstractIntrusion Abstract Intrusion detection is a important issue in computer network security．This paper Introduced the development in Firewall and intrusion detection first．Intrusion detec— tion is a facility which is equipped hidden behind Firewall．It works active to detect possible intrusion．Intrusion detection is very important because its the final shield to the intruder．From the point ofview oftechnique，intrusion detection consists of misuse detection and anomaly detection．There has been some anomaly detection algorithm，such as statistic method，artificial neural network method，expert systems and data mining algorithms．Data mining is a recently developed method used to discover knowledge in database．It’s strong to discover knowledge in huge data— bases．This paper lists all the methods mentioned above，and compared these methods by analyzing each’S strongpoints and disadvantages．And then demonstrated the app- liance ofdata mining method in intrusion detection in detail．In this paper we applied the sequential patterns mining method to anomaly detection．We compared the three main sequential patterns mining algorithms，and modified the best algorithm in performance _PrefixSpan to get faster mining speed and less memory consumption． We applied this developed algorithm to anomaly detection．We do experiments using a piece ofnetwork connection audit data．Finally，we gave the result analysis and conc— lusion． Key words Data mining；Intrusion