基于I-K-Means聚类的朴素贝叶斯HRNB分类算法在入侵检测中的应用研究

发布时间：2018-02-07 13:19

本文关键词： I-K-Means聚类检测率 HRNB分类算法网络安全入侵检测误检率近似度距离漏报率　出处：《河南理工大学》2014年硕士论文　论文类型：学位论文

【摘要】：高科技的发展带动了社会信息化的发展。网络技术的飞速发展使得越来越多的人开始发挥网络的作用来办理各种事物,与此同时网络安全问题也相应的成为社会发展的重要保障。现今是一个网络信息化的时代,防火墙对内部地进犯进行拦截已经是筋疲力尽,更不用说去阻挡来自外部的一些不法攻击。网络安全成为许多技术发展的重要保障。入侵检测在网络安全方面占有着一席之地。伴随着复杂化、多样化的网络入侵形式,入侵检测体系也必须达到更高的水平来匹配形式变化。本文首先是对入侵检测的相关研究进行一定的介绍。简要的介绍了贝叶斯的一些基础原理,剖析了利用朴素贝叶斯算法操纵入侵检测的缺点和弊端。本文的创新工作点如下:1).首先为了克服传统朴素贝叶斯对缺失数据的缺点,利用HRNB分类算法对朴素贝叶斯进行一个分层的分类,使得分为完整属性集和缺失属性集两类。在分层的过程中对每层都设置一个调控参数?,使得调控参数进行最优分类的调控。2).对原始的K-Means聚类算法进行改进,使得初始值的选取避免敏感。采用的是利用欧几里得距离公式计算类内和类间的近似度距离,使得类内距离达到最大,类间最小。3).融合I-K-Means聚类算法和HRNB分类算法,结合各自的优势,提出基于I-K-Means聚类的HRNB朴素贝叶斯分类算法,并且依据此算法建立入侵检测模型。本文提出的算法在KDD Cup 10%上进行了仿真实验。从实验结果可以分析得到,在对缺失数据的入侵检测中,改进后的算法相比较与传统的朴素贝叶斯分类算法使得数据的检测率提高了,误检率和漏报率降低了。在对各种攻击类型的入侵检测方面,检测率、误检率和漏报率方面都有相应的改善。证明了该算法具有一定的有效性和可用性。
[Abstract]:The rapid development of network technology makes more and more people begin to play the role of network to deal with all kinds of things. At the same time, the problem of network security has become an important guarantee for the development of society. Nowadays, in the era of network information, it is exhausting for firewalls to intercept the intruders. Not to mention blocking some illegal attacks from outside. Network security has become an important safeguard for the development of many technologies. Intrusion detection plays a role in network security. With the complexity and variety of network intrusion forms, Intrusion detection system must also reach a higher level to match the changes in form. Firstly, this paper introduces the relevant research of intrusion detection, and briefly introduces some basic principles of Bayes. This paper analyzes the shortcomings and drawbacks of manipulating intrusion detection by using naive Bayes algorithm. The innovation work of this paper is as follows: 1. First of all, in order to overcome the shortcomings of traditional naive Bayes for missing data, The HRNB classification algorithm is used to classify naive Bayes into two categories: complete attribute set and missing attribute set. In the process of delamination, a control parameter is set for each layer. The original K-Means clustering algorithm is improved to avoid sensitivity to the selection of initial values. The Euclidean distance formula is used to calculate the approximate distance between classes. By combining I-K-Means clustering algorithm and HRNB classification algorithm, a HRNB naive Bayesian classification algorithm based on I-K-Means clustering is proposed. Based on this algorithm, the intrusion detection model is established. The algorithm proposed in this paper is simulated on KDD Cup 10%. From the experimental results, it can be concluded that in the intrusion detection of missing data, Compared with the traditional naive Bayesian classification algorithm, the improved algorithm can improve the detection rate of data, reduce the false detection rate and false report rate. Both the false detection rate and the false report rate have been improved, and the effectiveness and availability of the algorithm have been proved.
【学位授予单位】：河南理工大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】