基于数据挖掘的入侵检测研究

Study on Data Mining Based Intrusion Detection for Network

网络入侵检测系统已经成为网络安全架构的一部分。但是当前的NIDS(network intrusion detection system)在未知攻击的检测上都存在虚警率过高的问题。首先对在线和离线系统的优缺点做了对比,重点介绍了分类器的集成学习和多检测器关联以及数据挖掘方法中的一些实用技术,然后介绍现存的系统和评价数据集,最后总结了入侵检测领域的工作并给出了这个领域的发展方向。

Network intrusion detection systems have become a part of security infrastructures. Unfortunately, high false alarm rate exists in current systems at detection unknown attacks. Firstly, the advantages and disadvantages between online system and offline system were compared, an integrated learning method of classifier and multi-sensor relation and some applicable techniques about data mining method were discussed in detail. Then many current intrusion detection system and evaluation datasets were introduced. Finally, the work in intrusion detection area was summarized ; the developing trend was given.