基于两水平算法的入侵检测系统的研究

Research on intrusion detection system based on two-level algorithm

针对现有入侵检测系统的检测时间范围具有一定局限性的缺陷,提出了一种基于两水平算法的入侵检测系统模型(TAIDS)。该模型利用两水平算法结合GMDH多层迭代的求解方法,按照不同时间范围的数据同时建模,可扩大系统检测入侵行为的时间范围。通过目标系统分析,寻求入侵影响因素之间的关系,建立最优模型, 有效地降低了漏检率和误检率。给出了系统框架和建模算法具体步骤,通过与Snort和NIDES入侵检测系统的仿真实验比较,证明该系统模型的有效性。

To the limitation of current intrusion detection models, an idea of formulating an intrusion detection model system （TAIDS） based on the GMTH Two-level algorithm was presented. With the joint of two-level algorithm and GMDH multi-stage iterate method, TAIDS would construct models simultaneously with data from different time range, which could enlarge the time range of the detected intrusive behavior. Through the analysis of the target system, relations between influential factors in intrusion were searched and an optimal model was built, which would decrease the false retrieval and fallout ratio efficiently. System framework and model algorithm were given also. This model system is proved to be effective from the comparison of emulating experiments on Snort and NIDES detection system.