摘要
网络入侵检测系统(N IDS)是一种检测网络入侵行为的工具,但在实际应用中,警报量多、误警率高,已经严重制约了N IDS的发展。文章分析了其产生的原因,提出了一种基于异常检测技术的N IDS警报分析系统模型;重点讨论了数据挖掘技术在该模型中的应用。
Nowadays many network intrusion detection systems （NIDSs） employ the misuse detection technology or the anomaly detection technology to detect network data streams and alarm attack attempts. In reality, too many alarms and the high false positive rate have already restricted the development of NIDSs. The causes are analyzed in this paper,and to solve the problems,a model based on anomaly detection is presented for analyzing the alarms in NIDSs. The application of database mining technology to extract the behavior of normal alarms of NIDSs is discussed in detail.
出处
《合肥工业大学学报（自然科学版）》
CAS
CSCD
北大核心
2005年第11期1377-1380,共4页
Journal of Hefei University of Technology：Natural Science
关键词
网络入侵检测系统
误警率
数据挖掘
异常检测
入侵警报
network intrusion detection system（NIDS）
false positive rate
data mining
anomaly detection
intrusion alarm
