基于数据挖掘的分布式入侵检测系统-计算机软件与理论专业论文.docxVIP

北京工业大学工学硕士学位论文Abst 北京工业大学工学硕士学位论文 Abst ract Intrusion detection plays a more and more important role in computer security． In conventional way，experts analyze data collected by intrusion detection system and abstract rule sets．Manual analysiS iS quite experts：ive because of enormous amount of data．Applying data mining technique in intrusion detection can reduce workload of manual analysiS． However data mining technique also has some problems，such as efficiency and accuracy．ThiS article proposes system architecture and datamining algorithm to enhance the efficiency of datamining intrusion detection system． Intrusion detection technology iS analyzed and explored in thiS thesis，and a Datamining and Agent—based Distributed Intrusion Detection Model iS presented in thiS thesiS．Based on thiS model，a Datamining and Agent—based Distributed Intrusion Detection System called DA DIDS iS developed．DA DIDS can be distributed On any host in the network．DA DIDS has good distributed and scalable ability because of its diStributed architecture and flexible agent system．DA DIDS’S real-time study ability can enhance the system’S detection effect． The agent system of DA DIDS consists of three main modules：transport service agent，datamining agent，intrusion detection agent．Every agent works independently and together to accomplish intrusion detection．Due to the agent system，DA_DIDS comes into being a uniform intrusion detection system that iS competent for the task of host—based and network—based intrusion detection．The introduction of the datamining technique gives the study ability to intrusion detection system，thiS ability makes the system to study and extract eigenvalues from logs of the host or from the network，then enlarge DA DIDS’S rul e database，the ability to detect intrusion can be enforced ceaselesslY． In thiS thesis，we implement the concrete functions of DA DIDS， clustering algorithm of datamining is analyzed detai ledly in the posterior chapters and is proved feasible throug