基于模糊聚类分析的网络入侵检测研究

发布时间：2018-11-16 12:01

【摘要】：随着互联网科技的迅速发展,越来越多的网络安全事故频繁发生。如今,信息网络所面临的破坏威胁已经不仅是原本的单主机的病毒感染,而是已经发展成为了来自全球各地的主机的入侵威胁,且入侵的风险性和多样性越来越复杂,因此对入侵检测方法的研究具有非常重要的实际意义。网络中的信息都是以数据的形式存在的,对入侵行为的检测,实际上就是一个对网络行为数据集合进行行为分类、信息挖掘的过程。这些数据信息通常规模较大,需要运用大数据分析中数据挖掘的方法。聚类分析作为统计学与计算数学的重要分支,是一种重要的数据挖掘分析方法,且由于算法的无监督性,更有利于智能化识别方式的实现。聚类分析的基本思想就是将一个数据样本按照一定的性质划分成相似的类,同一类中的数据对象彼此相似,并且与其他类中的数据对象不同。传统的聚类分析方法通常按较为严格的标准对类进行划分,一个数据对象只能划分到一个类中。而在现实情况中,很多客观问题的对象往往会有属于多个类的性质,需要使用“软划分”的方法,基于模糊数学的模糊聚类算法由此产生。模糊聚类分析方法引入了模糊数学中隶属度的概念,从理论上可以很好地支持软划分的分类思想。模糊聚类分析算法的应用范围比较广泛,可以更好的处理现实问题。使用模糊聚类分析的方法对入侵行为进行挖掘分析可以得到更好的分类结果,更加有利于对入侵模式的识别。本次论文着重研究了基于传递闭包的模糊聚类分析和模糊C-均值聚类分析算法,以及这两种算法在网络入侵检测样本数据中的具体应用。通过一系列的实验,对入侵检测样本数据进行分析处理,分析对比了传递闭包法与模糊C-均值聚类算法的应用效果,验证了模糊C-均值在处理入侵检测行为数据方面更加快速有效,具有更好的应用价值。
[Abstract]:With the rapid development of Internet technology, more and more network security accidents occur frequently. Today, the threat of destruction of information networks is not only a single host virus infection, but has developed into a host from all over the world, and the risk and diversity of intrusion is becoming more and more complex. Therefore, the research of intrusion detection method has very important practical significance. The information in the network exists in the form of data. The detection of intrusion behavior is actually a process of behavior classification and information mining for the data set of network behavior. These data information are usually large scale, need to use big data analysis of data mining method. As an important branch of statistics and computational mathematics, clustering analysis is an important method of data mining and analysis, and because of the unsupervised nature of the algorithm, it is more conducive to the realization of intelligent recognition. The basic idea of clustering analysis is to divide a data sample into similar classes according to certain properties. The data objects in the same class are similar to each other and different from the data objects in other classes. The traditional clustering analysis method usually divides the class according to the strict standard, a data object can only be divided into one class. However, in reality, many objects of objective problems often have the properties of multiple classes, which need to use the method of "soft partition", and the fuzzy clustering algorithm based on fuzzy mathematics is produced. The concept of membership degree in fuzzy mathematics is introduced in the fuzzy clustering analysis method, which can support the idea of soft partition in theory. Fuzzy clustering analysis algorithm is widely used and can deal with practical problems better. The method of fuzzy clustering analysis can be used to mine and analyze intrusion behavior, which can obtain better classification results and be more favorable to the recognition of intrusion patterns. This paper focuses on the fuzzy clustering analysis based on transitive closure and the fuzzy C-means clustering analysis algorithm, and their application in the network intrusion detection sample data. Through a series of experiments, the data of intrusion detection samples are analyzed and processed, and the application effects of transitive closure method and fuzzy C-means clustering algorithm are analyzed and compared. It is verified that fuzzy C-means is more efficient and efficient in dealing with intrusion detection behavior data, and has better application value.
【学位授予单位】：中国地质大学(北京)
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.13;TP393.08

【相似文献】