数据挖掘方法在网络入侵检测中的应用

Applications of data mining to network intrusion detection

传统的入侵检测系统存在适应性差、缺乏可扩展性、需要专家手工编码等缺陷。基于数据挖掘的入侵检测技术,自动地从训练数据中提取出入侵检测的知识和模式,能够很好地解决传统入侵检测系统中存在的问题。综述了数据挖掘技术在网络入侵检测中的应用,描述了基于数据挖掘的入侵检测系统架构,阐述了聚类分析、分类分析、关联规则分析和序列模式分析在网络入侵检测中的应用原理和最新的研究与改进,并指出了目前存在的问题和未来研究的方向。

There are many problems such as poor adaptability,limited extensibility and experts hand-coding in traditional intrusion detection systems.Data mining-based intrusion detection techniques can extract knowledge and patterns of abnormal intrusions and normal user profiles from training data automatically,hence resolving the problems of tradition IDS properly.Main applications of data mining to network intrusion detection are surveied,i.e.clustering analysis,classification analysis,association rule analysis and sequential patterns analysis.Basic principles of each as well as latest research and improvements.At last,a summary of existing problems and future research directions is given.