基于异常的入侵检测技术研究-计算机应用技术专业论文.docxVIP

河海犬学硕士研究生论文 河海犬学硕士研究生论文 英文摘要 ABSTRACT With tlle development of∞mpulers，communications and network techniqlIes， network infonnation sysIem has become an important infrastmcture of nation． Human can benefit from great contribution which network info哪ation system make to social civmzation，meanwhile realize that network inf0肌ation security has become an u唱ent probIem which aⅡ色cts long-te珊behalf and sustajning deVelopment of a nation．So，as a dynamic secufity protecIion technique，Int兀lsion Detection System (IDs)has become an imponant research domain of computer science and technjques． Thou曲have been enforced for more than 20 years，the research work of intnlsion detectjon techn010百es is still at its first phase with so many cnlcial problems jn conlmon as f01lowed： (1)Can only detect known intrusions but do nothing with a new one． (2)CaII do few help with the network administrator because of the high positiVe faIse rate． (3)Bad real-time ability After analysis and comparison of adVantages and disadVantages of recent detection tedmologies，we here make further research and design a light IDS PLADS(Payload-based Amomaly Detection System)which brings in data milling technology．Consjdering not the signature of known inIrusion but the feature of noⅡnal system，PlADS can detect new intlllsion，Taking netwoIk payload as system feature and Mahalanobis distance as algorithm，it can work wit量l low false positiVe rate and h{gh detection rate，Implying Mahalanobis as a linear algorithm，PLADS can work in reaI time．Finally tested with DAPRA99，PLAD can really work well as real time，anomaly based intrusion deIection sysIem． KEY WORDS：IDS，Anomaly Detection，Payload，Mahalanobis Djstance False Positive Rate II 河海大学硕士研究生论文 河海大学硕士研究生论文 第一章绪论 第一章绪论 随着信息时代的到来，电子商务、电子政务、金融网络、网络虚拟社区等已 经走进人们的日常生活，计算机网络已经成为现代社会生产、生活中不可或缺的 一部分，成为21世纪全球最重要的基础设施。但是，网络固有的开放性，尤其 是Internet的跨国界性，使网络一开始就面临巨大的安全风险。而网络协议、 各种软件的不完善以及网络管理人员的错误使这种风险成为现实的灾难，网络入 侵事件不断发生，甚至政府网站被破坏、军事机密被窃取。所有这些，都促使网 络安全研究工作快速向前发展。 1．1研究背景及意义 1．互联网中存在的安全威