基于决策规则格的入侵检测

Intrusion Detection Basing on Decision Rule Lattice

概念格是近年来获得飞速发展的数据分析的有力工具。本文对概念格进行扩展,提出了决策规则格的思想,并将其应用于入侵检测环境中,可以直接从决策规则格的格节点获取入侵行为模式。同时,将变精度粗糙集的β下近似思想应用于入侵检测规则获取,提出了β-约简,使入侵行为规则集的平均特征属性长度大大减小,而且规则集中规则的数目很少,可以有效、快速地实现对入侵行为分类,并能达到较高的分类正确率和很低的虚警率。

Concept lattice is a powerful data analytic tool, which develops quickly in recent years. A novel intrusion detection architecture based on Decision Rule Lattice, which is an extending of concept lattice, is proposed. This lattice structure can obtain the pattern of intrusion from lattice node directly. In addition, it applies β low approximation of variable precision rough set in intrusion detection rules, as well as provides β-reduction method which reduce average feature attribute length of intrusion activity rules and account of rules. Experimental results show that it can classify intrusion activities effectively and quickly with higher classification accuracy and lower false positive accuracy.