基于聚类的离群点挖掘在入侵检测中的应用研究

发布时间：2018-11-04 08:29

【摘要】：伴随着计算机网络技术的高速发展,人类社会的高度信息化已成为一种趋势,网络中的安全问题也逐渐的凸显出来,这引起人们极大的关注。入侵检测作为计算机安全领域中一个重要组成部分,在安全保护体系有着重要的作用。近年来,数据挖掘的各种技术大量的应用于入侵检测,但大多数算法只是针对数据集做一般模式的研究,然而在实际生活中,各个领域内经常出现的一些与数据集中大多数行为或模型不一致的数据对象,这些对象统称为离群点。离群点识别检测,针对的是数据集小模式。在网络活动中,入侵行为占的比例仅是很小的一部分,入侵行为在本质上也异于正常行为。因此,采用离群点挖掘技术来检测入侵行为包括检测出一些未知的入侵行为具有一定的理论基础和实践意义。本文主要研究了基于聚类的离群点挖掘算法在入侵检测应用,详细的介绍了国内外有关聚类的离群点挖掘算法,并对其在入侵检测中的应用进行了深入的研究;在通用入侵检测模型的基础上设计了基于离群点挖掘方法的入侵检测模型,同时针对传统的DBSCAN算法做了改进,并在此基础上提出一种聚类算法与离群点挖掘算法相结合的入侵检测方法,通过聚类算法先剪除掉大量密集型数据,然后采用离群点挖掘算法进行分析检测,通过实验证明该改进算法有较高的性能。本文主要工作包括:(1)深入的研究了入侵检测相关技术,并对入侵检测技术的研究现状做了分析,详细阐述了数据挖掘方法在入侵检测中的应用,分析了不同的离群点挖掘方法、聚类方法它们在入侵检测中的应用现状以及优缺点。(2)深入分析了入侵检测模型,并在通用入侵检测模型的基础上给出了一种针对离群点挖掘算法的入侵检测模型。(3)对传统的DBSCAN算法进行了深入的分析与研究,然后针对算法在收敛速度上的不足对其进行改进,提高了DBSCAN算法的性能,并提出一种聚类算法和局部离群点挖掘算法相结合的入侵检测算法。(4)对网络数据集即KDD CUP 99进行研究分析,并针对本文提出的改进的DBSCAN算法对数据集进行剪枝处理;用局部离群点挖掘算法中进行检测试验,检测算法的效果。本文提出改进的DBSCAN算法与局部离群挖掘算法相结合的方法应用于入侵检测中,并从检测率和误报率两方面采用实验的方法对该算法进行性能评估。实验表明,局部离群点挖掘算法对异常入侵检测有较好的效果。
[Abstract]:With the rapid development of computer network technology, the highly information of human society has become a trend, the network security issues are gradually highlighted, which caused great concern. As an important part of computer security, intrusion detection plays an important role in security protection system. In recent years, a variety of data mining techniques have been widely used in intrusion detection, but most of the algorithms only focus on the general pattern of data sets, but in real life, Some data objects which are not consistent with most behaviors or models in data sets are often found in various fields. These objects are collectively called outliers. Outlier detection is aimed at the small pattern of data set. In the network activities, the proportion of intrusion is only a very small part, intrusion behavior is different from normal behavior in essence. Therefore, the use of outlier mining technology to detect intrusion behavior including detection of some unknown intrusion behavior has certain theoretical basis and practical significance. This paper mainly studies the application of outlier mining algorithm based on clustering in intrusion detection, introduces the clustering outlier mining algorithm at home and abroad in detail, and makes a deep research on the application of outlier mining algorithm in intrusion detection. Based on the general intrusion detection model, an intrusion detection model based on outlier mining is designed, and the traditional DBSCAN algorithm is improved. On this basis, an intrusion detection method combining clustering algorithm with outlier mining algorithm is proposed. Firstly, a large amount of intensive data is removed by clustering algorithm, and then outlier mining algorithm is used to analyze and detect outliers. Experiments show that the improved algorithm has high performance. The main work of this paper is as follows: (1) the related technology of intrusion detection is deeply studied, and the research status of intrusion detection technology is analyzed, and the application of data mining method in intrusion detection is described in detail. Different outlier mining methods are analyzed, their application status in intrusion detection and their advantages and disadvantages are analyzed. (2) intrusion detection model is deeply analyzed. Based on the general intrusion detection model, an intrusion detection model for outlier mining algorithm is proposed. (3) the traditional DBSCAN algorithm is deeply analyzed and studied. Then the algorithm is improved to improve the convergence speed of the algorithm, and the performance of the DBSCAN algorithm is improved. An intrusion detection algorithm combining clustering algorithm and local outlier mining algorithm is proposed. (4) the network data set (KDD CUP 99) is studied and analyzed, and the improved DBSCAN algorithm is used to prune the data set. The local outlier mining algorithm is used to detect the effect of the algorithm. In this paper, the improved DBSCAN algorithm and the local outlier mining algorithm are proposed to be applied to intrusion detection, and the performance of the algorithm is evaluated by experimental methods in terms of detection rate and false alarm rate. Experiments show that local outlier mining algorithm has a good effect on anomaly intrusion detection.
【学位授予单位】：重庆大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP311.13;TP393.08

【相似文献】