基于区间值2型模糊集的伪装入侵检测算法

Masquerade Intrusion Detection Algorithm Based on Interval Type-2 Fuzzy Set

由于正常用户的行为本身是变化的,且伪装用户的行为可能看起来是正常的,这种不确定性使得现有的伪装检测算法很难正确判断用户身份的真实性,从而限制了现有算法的实际应用推广.本文合理地选择用户的行为特征,并建立相应的用户可信度计算方法,采用区间值模糊集对多个特征进行可信度综合计算得到用户的最终可信度,将该值与设定的阈值比较从而判断用户是否属于伪装.理论分析及实验结果显示,与普通模糊计算相比,区间值模糊计算能有效表示及处理伪装检测中的不确定性,因而能得到比较理想的检测效果.

User activities are normally in variant forms or may be aberrant in some cases. This kind of uncertainty leads to the difficulty for current intrusion detection algorithm in deciding whether the user is masquerading or not. In the proposed algorithm, the user features are properly selected and the corresponding user trustworthiness computation methods are introduced. Different types of trustworthiness are integrated with interval type-2 fuzzy set,thus user trustworthiness is got and applied to a thresholdbased decision. Theory analysis and experiments show that the proposed algorithm can handle the uncertainties that exist in user actirity or user model, so better detection performance can be achieved, compared with the detection algorithm based on ordinal fuzzy set.