基于数据缺值的贝叶斯网络入侵检测研究
发布时间：2019-06-28 12:57
【摘要】：随着网络技术的快速发展,计算机与互联网给人类的生活带来了翻天覆地的变化,它们在经济、文化等领域也发挥着举足轻重的作用。与此同时计算机及网络安全问题日益严峻,在这种背景下,入侵检测成为关注的焦点。入侵检测可以实时地对计算机系统进行监控,保证系统安全,近年来得到了广泛的应用。但入侵检测系统占用了较高的计算机资源,如何提高系统性能一直是学者们研究的核心问题。本文主要利用贝叶斯网络对入侵检测展开研究。贝叶斯网络作为一种强大的概率推理工具,它不仅降低了朴素贝叶斯对于属性间条件独立的要求,而且简明地展示了属性之间的依赖关系,降低了入侵检测模型的复杂度。首先,本文分析了入侵检测模型存在的主要问题,介绍了相关技术。之后对粗糙集理论及它在属性约简中的应用做了详细的分析;最后构建了基于贝叶斯网络的入侵检测模型。针对不完备数据集,本文提出了R-BN算法。该算法以粗糙集中的分明矩阵为基础,找到数据集中与缺失对象最相似的对象,利用该对象属性值对缺失对象进行补齐。通过实验比较了R-BN算法与常规补齐算法构建的模型的分类效率,分类正确率得到了大幅提高。针对静态模型在网络环境发生改变时,影响分类效率的问题,本文提出了结构动态变化的R-BN算法。该算法引入滑动窗口,将分类后的数据对象添加至数据集尾部,随着窗口滑动实现数据的更新。当网络环境发生变化时,算法比较两个窗口间的相对欧几里得距离,判断是否更新贝叶斯网络结构与参数,并通过实验验证了模型分类的正确性,相对于静态模型,该模型的分类正确率得到了一定提高。
[Abstract]:With the rapid development of network technology, computer and Internet have brought earth-shaking changes to human life, and they also play an important role in economy, culture and other fields. At the same time, the problem of computer and network security is becoming more and more serious. In this context, intrusion detection has become the focus of attention. Intrusion detection can monitor the computer system in real time to ensure the security of the system, which has been widely used in recent years. However, intrusion detection system occupies high computer resources, how to improve the performance of the system has been the core issue of scholars. In this paper, Bayesian network is used to study intrusion detection. As a powerful probabilistic reasoning tool, Bayesian network not only reduces the requirement of naive Bays for conditional independence between attributes, but also succinctly shows the dependence between attributes and reduces the complexity of intrusion detection model. First of all, this paper analyzes the main problems of intrusion detection model, and introduces the related technologies. Then the rough set theory and its application in attribute reduction are analyzed in detail. Finally, an intrusion detection model based on Bayesian network is constructed. In this paper, a R-BN algorithm is proposed for incomplete data sets. Based on the clear matrix of rough set, the algorithm finds the object which is most similar to the missing object in the data set, and uses the attribute value of the object to complement the missing object. The classification efficiency of the model constructed by R-BN algorithm and conventional complement algorithm is compared by experiments, and the classification accuracy is greatly improved. In order to solve the problem that the static model affects the classification efficiency when the network environment changes, a R-BN algorithm with dynamic structural change is proposed in this paper. In this algorithm, sliding window is introduced, the classified data object is added to the tail of data set, and the data is updated with window sliding. When the network environment changes, the algorithm compares the relative Euclidean distance between the two windows, determines whether to update the Bayesian network structure and parameters, and verifies the correctness of the model classification through experiments. Compared with the static model, the classification accuracy of the model is improved to a certain extent.
【学位授予单位】：北方民族大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08
[Abstract]:With the rapid development of network technology, computer and Internet have brought earth-shaking changes to human life, and they also play an important role in economy, culture and other fields. At the same time, the problem of computer and network security is becoming more and more serious. In this context, intrusion detection has become the focus of attention. Intrusion detection can monitor the computer system in real time to ensure the security of the system, which has been widely used in recent years. However, intrusion detection system occupies high computer resources, how to improve the performance of the system has been the core issue of scholars. In this paper, Bayesian network is used to study intrusion detection. As a powerful probabilistic reasoning tool, Bayesian network not only reduces the requirement of naive Bays for conditional independence between attributes, but also succinctly shows the dependence between attributes and reduces the complexity of intrusion detection model. First of all, this paper analyzes the main problems of intrusion detection model, and introduces the related technologies. Then the rough set theory and its application in attribute reduction are analyzed in detail. Finally, an intrusion detection model based on Bayesian network is constructed. In this paper, a R-BN algorithm is proposed for incomplete data sets. Based on the clear matrix of rough set, the algorithm finds the object which is most similar to the missing object in the data set, and uses the attribute value of the object to complement the missing object. The classification efficiency of the model constructed by R-BN algorithm and conventional complement algorithm is compared by experiments, and the classification accuracy is greatly improved. In order to solve the problem that the static model affects the classification efficiency when the network environment changes, a R-BN algorithm with dynamic structural change is proposed in this paper. In this algorithm, sliding window is introduced, the classified data object is added to the tail of data set, and the data is updated with window sliding. When the network environment changes, the algorithm compares the relative Euclidean distance between the two windows, determines whether to update the Bayesian network structure and parameters, and verifies the correctness of the model classification through experiments. Compared with the static model, the classification accuracy of the model is improved to a certain extent.
【学位授予单位】：北方民族大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08
【参考文献】
相关期刊论文 前10条
1 王双成;杜瑞杰;刘颖;;连续属性完全贝叶斯分类器的学习与优化[J];计算机学报;2012年10期
2 张新有;曾华q，
本文编号：2507321
本文链接：https://www.wllwen.com/guanlilunwen/ydhl/2507321.html
