网络协议分析与决策树挖掘的入侵检测模型研究

ON INTRUSION DETECTION MODEL BASED ON NETWORK PROTOCOL ANALYSIS AND DECISION TREE MINING

在入侵检测系统中,采用网络协议分析技术可以有效地减少数据包的搜索空间。结合网络协议分析技术和决策树挖掘技术,提出一种新型的入侵检测模型。该模型首先分析数据包的协议类型,然后根据协议类型来确定最佳的决策树算法以进行入侵检测。实证研究表明,该模型较传统的基于决策树的入侵检测模型具有更高的准确性,更适合于目前高速网络环境中的入侵检测要求。

Network protocol analysis can be used to effectively reduce searching space of data packet in intrusion detection system. This paper purposes a novel intrusion detection model based on the techniques of network protocol analysis and decision tree mining. The model first analyses the protocol types to which the data packet belongs, and then determines the optimal decision tree algorithm according to the protocol type for conducting the intrusion detection. Study on actual demonstration indicates that, this model outperforms the conventional decision tree-based intrusion detection model with higher accuracy, and is more suitable to the requirements of intrusion detection in current high network environment.