基于关联规则的入侵系统设计与实现-计算机应用技术专业论文.docxVIP

II II 摘 要 近年来，随着网络的迅速发展，网络安全问题日益严重。传统的网络安全防护技 术和入侵检测技术已经不能检测越来越复杂的网络攻击。如何提取网络入侵特征，以 及检测新型的网络攻击成了当前入侵检测研究的主要方向。而数据挖掘技术能够很好 的对海量数据进行分析并从中获取隐藏在数据背后的规则特征，把数据挖掘技术应用 到入侵检测系统中，可以得到很好的效果。 本文首先对入侵检测技术的概念、分类，并详细描述其研究技术，描述了当前入 侵检测技术发展的趋势及存在的问题。其次本文描述了关联规则，指出了其优缺点。 之后本文就当前入侵检测系统的性能评估作了介绍，并给出了基于回报期望模型的入 侵检测评估方法，并通过实验证明了其可行性，然后就此提出了反馈控制系统，该系 统可以自动优化规则库。本文的重点是给出了基于 snort/bro 的分布式反馈控制入侵检 测防护系统，该系统弥补了当前流行的 snort 入侵检测系统只能检测到网络底层的入 侵，对于网络高层的入侵形式无法检测的缺点。同时实现了双规则库的应用，该应用 有效地提高了关联规则的准确率。 最后，对本文的工作进行了总结，指出了本文所作的努力和工作，同时指出了本 文的不足。 本文所作的努力和工作：给出了基于回报期望模型的入侵检测性能评估模型和基 于 snort/bro 的分布式反馈控制入侵检测防护系统。 关键字：入侵检测；关联规则； snort；bro；回报期望模型 III III Abstract Abstract With the rapid development of the network in recent years, network security is becoming increasingly serious. Traditional network security technologies and intrusion detection technology have been unable to detect increasingly sophisticated network attacks. How to extract the characteristics of network intrusion, as well as how to identify a new type of network attack has become the main direction study of the current intrusion detection. Data mining technology is not only good at analyzing massive data, but also extracting the characteristics rules which hide behind the data. Data mining technology applies to network intrusion detection has more important value of results. Firstly，the concept, classification and research techniques of intrusion detection are described in detail in this paper, which presents current development trends and problems of intrusion detection. Furthermore, association rule is described which advantages and disadvantages are presented in this paper. And then, the performance evaluation of current intrusion detection system is introduced and the intrusion detection evaluation method based on newsboy model is proposed that the experiment proved its feasibility，and feedback control system is proposed which can optimize the rule base automatically. This paper focuses on that the distributed feedback control intrusion d