基于数据挖掘的入侵检测系统研究

Research on Intrusion Detection System Based on Data Mining

针对传统入侵检测系统存在的问题,提出将数据挖掘技术应用到入侵检测系统中,分析了常用于入侵检测技术中的数据挖掘方法,并将关联分析与分类分析应用到基于主机日志的异常检测中,对数据挖掘算法和如何将数据挖掘算法应用到入侵检测系统进行了研究。实现了一个基于主机日志数据的挖掘模块,通过对IIS日志文件的挖掘,生成访问异常关联规则,为入侵检测系统服务。

In order to solve problems existing in traditional intrusion detection systems, this paper puts forward the application of data mining technology in intrusion detection while analyzing recent main data mining methods, and applying the Association and Classification pattern mining into host logs based anomaly detection. Data mining algorithms and its application in intrusion detection are also researched. We implement a data mining module based on the logs of host. The mining that comes from IIS logs file generates anomaly access rules that serves for the IDS.