自适应入侵检测专家系统模型

Adaptive Intrusion Detection Expert System Model

大多数入侵检测系统不能适应网络环境的变化,即不具备自适应性。针对此情况,提出了自适应策略,该策略由状态空间和策略空间构成,状态空间用来描述网络环境,策略空间用来描述采用的策略。对于状态空间中的某一具体的环境状态,在策略空间存在唯一的策略与之对应。在构建自适应策略的基础上,将基于规则的推理和基于事例的推理相结合,设计了自适应入侵检测专家系统模型(AIDESM)。AIDESM既有专家知识库,又有入侵事例库,利用自适应策略和评价学习机制,能够实现自适应入侵检测。实验结果表明,该自适应策略是比较有效的。

Most intrusion detection system can not adapt to the variation of network environment. Aiming at this problem, this paper proposes an adaptive strategy which composed of state space and strategy space. The former described network environment and the latter described the strategies. There is an exclusive strategy corresponds to a certain environment state in state space. On the base of the adaptive strategy, it designs an adaptive intrusion detection expert system model based on rule-based reasoning and case-based reasoning, namely, AIDESM, which had expert knowledge database and intrusion case database. It takes advantage of adaptive strategy and evaluation ＆ learning mechanism to realize adaptive intrusion detection. The experiments indicate that adaptive strategy is effective.