基于有效载荷的多级实时入侵检测系统框架

发布时间：2018-06-26 14:46

本文选题：入侵检测 + 数据预处理　；参考：《计算机科学》2014年04期

【摘要】：网络入侵检测系统使用大量特征集来识别入侵,需要处理庞大的网络流量,目前大多数现有的系统缺乏实时异常检测能力。提出了一种基于有效载荷的多级实时入侵检测系统,它首先采用n-gram分析网络数据包有效载荷来构建特征模型,进行数据准备;其次采用3级迭代特征选择引擎进行特征子集选择,其中主成分分析用于数据的预处理,并结合累积能量、平行分析和碎石检验进行主成分选择;最后采用马氏距离图发现特征间及数据包间隐藏的相关性。马氏距离的差异性准则用来区分正常或攻击数据包。通过DARPA 99和GATECH数据集验证了该系统的有效性,用Web应用程序流量验证了其模型,用F值评估了其检测性能。与目前同类主流的两款入侵检测系统进行了对比试验,结果表明:该系统提高了检测精度,降低了误报率和计算复杂度。与中型企业网的真实场景相比,它具有1.3倍的高吞吐量。
[Abstract]:Network intrusion detection systems use a large number of feature sets to identify intrusion, which need to deal with huge network traffic. At present, most of the existing systems lack real-time anomaly detection capability. A multi-level real-time intrusion detection system based on payload is proposed. Firstly, n-gram is used to analyze the payload of network packets to construct the feature model and prepare the data. Secondly, three stage iterative feature selection engine is used for feature subset selection. Principal component analysis (PCA) is used to preprocess the data, and combined with cumulative energy, parallel analysis and gravel test, principal component selection is carried out. Finally, Mahalanobis distance graph is used to find the hidden correlation between features and data packets. The difference criterion of Markov distance is used to distinguish normal or attack packets. The validity of the system is verified by DARPA99 and GATECH data sets, the model is validated with Web application flow, and its detection performance is evaluated with F value. The results show that the system improves the detection accuracy and reduces the false alarm rate and computational complexity. Compared with the real-time scenario of medium-sized enterprise networks, it has a high throughput of 1.3 times.
【作者单位】：盐城工学院信息工程学院;北京工业大学计算机学院;
【基金】：国家自然科学基金(61272500)资助
【分类号】：TP393.08

【参考文献】