基于adaboost的linux主机入侵检测系统研究-计算机应用技术专业论文.docxVIP

摘 摘 要 桂林电子科技大学学位论文 桂林电子科技大学学位论文 摘 要 随着入侵检测技术的重要性日益凸显以及Linux操作系统的地位不断提升，对Linux 入侵检测系统进行研究具有重要的现实意义。目前Linux下的入侵检测系统主要使用 基于规则匹配和数据完整性校验的模式构建，大部分不具备智能的自适应能力，可扩 展性差，检测性能有待提高。本文采用网格技术和集成学习算法AdaBoost，设计了一 个新型结构的智能Linux主机入侵检测系统。论文的主要创新工作有: Linux主机入侵检测系统设计中引入了网格技术。系统的数据采集节点采用网格开 发工具包Globus Toolkit搭建网格环境，分布式采集Linux主机信息和与Linux主机相关 的网络信息:通过网格中间件OGSA-DAI实现特征数据的访问和集成，并以网格服务 的形式将特征数据提交给分析中心进行检测分析。网格技术有效地解决了传统Linux主 机入侵检测系统中负载集中、可扩展能力差等问题。 提出一种基于AdaBoost的入侵特征约减算法，利用该算法约减入侵特征中的冗余 特征。在该算法基础上构造Ada-加权、Ada-域值分类器，并与支持向量机分类器进行 对比。Linux主机入侵检测系统实验平台验证了特征约减算法和分类方法的有效性。 提出一种分级结构的AdaBoost入侵检测方法。该方法通过级连多个分类器来共同 完成检测任务，每一级的分类器都是Ada-域值分类器。在Linux主机入侵检测系统的实 验平台上训练和测试分级结构的智能入侵检测器，实验结果表明，该方法取得了理想 的检测性能。 关键词:Linux主机入侵检测系统:AdaBoost:网格技术:特征约减:分级结构 万方数据 I – – – PAGE IV – 万方数据 – – PAGE III – 万方数据 Abstract With the outstanding of the importance on the techniques of intrusion detection, and the ever promoting position of Linux operating system, the research on Linux in- trusion detection system is considered surely of great significance. At present, Linux intrusion detection system is mainly used for the pattern construction based on rule- matching and data integrality, so most of them do not have self-adaptive intelligence, and are also weak at extensibility. Hence, the performance of detection is to be im- proved. In this thesis, a Linux host intrusion detection system is designed, by using grid technology, as well as AdaBoost-an ensemble learning algorithm. The main novel contributions of this thesis are listed as follows: Grid technology was used in the design of Linux host intrusion detection system. In this system, grid environment was build by Globus Toolkit on the data collection nodes; the Linux host’s feature data and the network’s feature data correlated to the Linux host were collected on the distributed nodes; the integration and access of the distributed feature data were realized via grid middleware OGSA-DAI; and the related data were send to analysis center as one of grid services. By