免疫入侵检测中基于信息增益的检测器生成研究

发布时间：2018-04-18 08:16

本文选题：入侵检测 + 人工免疫　；参考：《哈尔滨理工大学》2014年硕士论文

【摘要】：随着网络技术的飞速发展，网络安全问题也越来越突出，传统的入侵检测技术已经很难应付各种复杂的网络攻击。免疫系统具有的自适应、自组织和分布性正是传统的入侵检测技术所期望的特性。因此，基于免疫的入侵检测技术已经引起了越来越多的专家学者的关注。入侵检测系统经常要面对大量的大规模的数据，免疫入侵检测系统也不例外。免疫入侵检测中用来完成检测功能的组件主要是检测器，它的性能直接影响检测的效果，而实值检测器在处理高维数据时表现的效果较差。针对这个问题，本文将文本分类研究中的信息增益理论引入到的免疫入侵检测中。首先，通过对高维空间中维数灾难问题的分析，总结了实值检测器在高维空间中性能较差的主要原因。高维空间中实值检测器的检测范围小而且分布不均匀，本文采用了信息增益的属性选择来控制检测器/自体集的维度，使形态空间保持在一个合理的维度内。其次，针对实值检测器处理高维数据性能较差的问题，，本文提出了基于信息增益的检测器生成算法，通过选取信息增益大的属性组合成新的特征空间，并在新的特征空间中训练生成检测器，使得检测器可以在低维空间中对高维数据进行异常检测。最后，通过离线数据集Kddcup99验证了本文提出的基于信息增益的检测器生成算法的有效性。
[Abstract]:With the rapid development of network technology, network security problems become more and more prominent. Traditional intrusion detection technology has been difficult to cope with various complex network attacks.The adaptive self-organization and distribution of immune system are the expected characteristics of traditional intrusion detection technology.Therefore, immune-based intrusion detection technology has attracted more and more attention of experts and scholars.Intrusion detection systems often face a large number of large-scale data, immune intrusion detection system is no exception.In immune intrusion detection, the main component used to complete the detection function is the detector. Its performance directly affects the detection effect, but the real value detector has a poor performance in dealing with high-dimensional data.To solve this problem, the information gain theory of text classification is introduced into the immune intrusion detection.Firstly, by analyzing the problem of dimensionality disaster in high dimensional space, the main reasons for the poor performance of real value detector in high dimensional space are summarized.In high dimensional space, the detection range of real value detector is small and the distribution is uneven. In this paper, the attribute selection of information gain is used to control the dimension of detector / self-set to keep the morphological space within a reasonable dimension.Secondly, aiming at the problem of poor performance of real value detector in dealing with high dimensional data, a detector generation algorithm based on information gain is proposed in this paper, which combines attributes with large information gain into a new feature space.The generation detector is trained in the new feature space to detect the anomaly of the high-dimensional data in the low-dimensional space.Finally, the effectiveness of the proposed detector generation algorithm based on information gain is verified by off-line data set Kddcup99.
【学位授予单位】：哈尔滨理工大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】