一种基于划分的入侵检测新方法研究

发布时间：2018-05-14 18:36

本文选题：粗糙集 + 划分　；参考：《辽宁科技大学》2014年硕士论文

【摘要】：随着信息技术的不断成熟和网络技术的飞速发展，，网络逐渐成为人们生活中不可缺少的一部分。但是，人们在享受着信息革命所带来的便利的同时，也将不可避免的面对信息网络安全问题所带来的巨大挑战。作为网络安全防护机制的关键环节和网络安全技术的一大核心技术，入侵检测技术正得到快速的发展并日渐成熟起来。基于数据挖掘的入侵检测，将整个入侵检测系统建立的过程视为一个对训练数据集的挖掘过程。最大限度地降低了对领域先验知识的需求和人工的参与程度，明显地提高了入侵检测和入侵响应的效率。粗糙集理论作为一种拥有着成熟数学基础且不需要先验知识支持的用于分析和处理不确定、不完整、不一致性信息的有效工具，无论是对数据挖掘的预处理阶段还是在数据挖掘阶段都能起到很大的帮助作用。本文在对kddcup99数据集进行一定的统计分析研究的基础之上，运用粗糙集理论中的等价类划分思想。首先利用一定的先验知识根据service的取值不同对原kddcup99训练数据集进行等价类划分，解决了现有研究中kddcup99数据集因庞大而不易处理的难题。然后根据传统离散化算法对各个划分进行离散化操作，极大地减小了后期运算的复杂程度。其次在属性约简和值约简过程中，再次将划分思想运用其中，将二者合二为一，在保证整个决策表一致性的前提下，得到了近似最小的约简结果，最后以此为依据，快速准确地建立起整个入侵检测系统规则库。实验结果表明，本文方法在保证高检测率低误报率低漏检率的前提下，明显地降低了数据挖掘过程各阶段的的复杂程度。
[Abstract]:With the continuous maturity of information technology and the rapid development of network technology, the network has gradually become an indispensable part of people's life. However, while enjoying the convenience brought by the information revolution, people will inevitably face the enormous challenge brought by the information network security. As a key link of network security protection mechanism and a core technology of network security technology, intrusion detection technology is developing rapidly and maturing day by day. Intrusion detection based on data mining, the process of establishing the whole intrusion detection system is regarded as a mining process of the training data set. The requirement of domain prior knowledge and the degree of human participation are greatly reduced, and the efficiency of intrusion detection and intrusion response is obviously improved. Rough set theory is an effective tool for analyzing and processing uncertain, incomplete and inconsistent information, which has a mature mathematical foundation and does not require prior knowledge support. Both the preprocessing stage and the data mining stage of data mining can be of great help. Based on the statistical analysis of kddcup99 data sets, this paper applies the theory of equivalent class partition in rough set theory. Firstly, the prior knowledge is used to partition the original kddcup99 training data set according to the value of service, which solves the problem that the kddcup99 data set is difficult to deal with because of its huge size. According to the traditional discretization algorithm, each partition is discretized, which greatly reduces the complexity of the later operation. Secondly, in the process of attribute reduction and value reduction, the partition idea is used again, and the two are combined into one. On the premise of ensuring the consistency of the whole decision table, the approximate minimum reduction results are obtained. The rule base of the whole intrusion detection system is established quickly and accurately. The experimental results show that the method can obviously reduce the complexity of the data mining process on the premise of high detection rate and low false alarm rate.
【学位授予单位】：辽宁科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】