基于数据挖掘的网络入侵检测系统研究-计算机软件与理论专业论文.docxVIP

基于数据挖掘的网络入侵检测系统研究摘要 基于数据挖掘的网络入侵检测系统研究 摘要 随着网络的不断发展，安全的重要性越来越突出，原有的防火墙已经难以 单独保障网络的安全，入侵检测系统开始发挥出不可替代的作用。然而，现有 的入侵检测系统在有效性、适应性和可扩展性等方面都存在不足，尤其是在遇 到新的入侵类型时显的无能为力，针对这些不足，本文从数据处理的角度，用 数据挖掘的方法建立了入侵检测的模型。由于入侵检测系统处理的数据含有大 量的冗余与噪音特征，使得系统耗用的计算资源大，导致系统训练时间长、实 时性差，检测效果不好。特征选择能够很好地消除冗余和噪音特征，有利于提 高入侵检测系统的检测速度和效果，因而对基于特征选择的入侵检测系统进行 研究是必要的，也符合入侵检测领域的发展趋势。 本文提出了一种基于过滤器模式特征选择的入侵检测系统模型，分别用 Chi2、信息增益和FCBF三种不同的算法进行特征选择，用决策树作为分类算 法。按照DoS，PROBE，R2L，U2R四个类别对KDD CUP’99数据集进行分类， 并且在每一类上进行了大量的实验。实验结果表明，对每一类攻击，由本文提 出的特征选择算法构建的入侵检测系统在建模时间、检测时间、检测己知攻击、 检测未知攻击上，与没有运用特征选择的入侵检测系统相比具有更好的性能。 关键词：入侵检测，数据挖掘，特征选择，决策树 UI Research Research on Network Intrusion Detection Based on Data Mining Abstraet With the progress of network，the importance of security is become more and more obvious，the traditional security device firewall has difficult in protecting network security alone．However，current intrusion detection systems lack of effectiveness，adaptability and extensibility，and especially,they become ineffective in the face of detecting new kind of attacks．Aimed at these shortcomings，this thesis takes a data．centric view to IDS and builds an intrusion detection model by mining audit data．As the data intrusion detection system processed contains a lot of redundancy and noise characteristics causing slow training and testing process，high resource consumption as well as poor detection rate．Feature selection eliminate redundant and noisy features well．In order to improve performances of intrusion detection system in terms of detection speed and detection rate，thus a survey of intrusion detection system based on feature selection iS necessary．and also conforms to the trend in the field of intrusion detection． An intrusion detection system model based on filter．model feature selection iS introduced in the thesis．The algorithm of Chi—square，information gain and FCBF are adopted respectively to select features，and the algorithm of decision tree is used as classification approach．The author have examined the feasibi