一类基于模式分类算法的入侵检测系统

One Pattern Recognition Algorithm Applied in Intrusion Detection

目前,入侵检测技术(IDS)作为网络安全领域研究的焦点,主要分为两种:误用检测和异常检测,误用检测是根据已知的入侵手段建立一个规则库,待检测的信息与库中规则进行匹配达到检测目的.优点是检测结果准确率高,缺点是只能检测到已知入侵类型.异常检测是通过构造正常的用户轮廓来检测用户的行为,优点是可以检测到未知的入侵行为,但是技术不成熟,误报率高.本文尝试通过结合二者的优点,同时创建了描述正常用户行为和异常行为两个向量集,并引入一种广泛应用于图象处理技术中的模式识别算法依据这两个向量集来判断待测用户行为的属性,识别出黑客的入侵行为.

At present, Intrusion detection technique has become the focus in the area of network security research. Intrusion detection technique is divided into anomaly detection and misuse detection. Misuse detection refers to intrusions that follow well-defined patterns of attacks that exploit weaknesses in the system. Misuse detection techniques have high detection rate for already known attacks but show poor performance in the presence of a new attack or even a variant of previously known attack.. Anomaly detection is an effort to recognize unusual behavior through a profile describing normal behavioral patterns. This measure can discriminate the unknown methods of intrusion but the technique is not mature and the rate of false positives is high. This paper creates two vector-sets through combining the advantages of the two measures. One describes the behavior of normal users and the other describes that of unusual users, and then introduces a pattern recognition algorithm which is used in image processing technique to judge the behavioral attribute of users to be detected.