一种数据库入侵检测模型的设计与实现

Design and Implementation of a Database Intrusion Detection Model

本文针对传统数据库入侵检测系统检测时对时间和空间要求比较高,设计了一种在进行关联规则挖掘之前,先用聚类分析k-means算法对用户正常历史数据进行聚类,以缓解关联规则算法对时间和空间的要求,再利用关联规则FP_Growth算法进行挖掘形成知识规则库,在数据库系统正常运行阶段,利用入侵检测算法检测数据库异常行为和进行的恶意事务操作。同时使用代理技术将数据库入侵检测系统与数据库服务器分离,降低服务器的系统开销,提高了检测系统的运行效率。

The traditional database intrusion detection system requires high quality of the time and space.in this paper,We first use the rules of k-means clustering algorithm for the normal userhistory data category To alleviate the association rules algorithm for time and space requirements,hen use the association rules of mining algorithm FP_Growth to form the rule base of knowledge. During running stage of database systems,the database intrusion detection algorithm are used to detect abnormal behavior and malicious affairs operation. At the same time, the database intrusion detection system is separated from the database server with agent technology, reducing cost of the server and improving the efficiency of detection systems.