扩展D-S证据理论在网络异常检测中的研究

Research on extended D-S theory in network anomaly detection

网络异常检测是入侵检测系统中重要的组成部分,然而传统网络异常检测方法中存在虚警率高、单一检测算法对多种入侵行为的检测不够全面等问题。提出了一种基于改进D-S证据理论融合多个分类器的分布式网络异常检测模型及其融合方法。鉴于经典D-S证据理论在证据间存在冲突时的不合理,采用一种带权重的改进型D-S证据理论,提出一种全新的融合策略融合多个分类器建立异常检测模型。通过KDD99数据集对该模型进行验证,结果证明该异常检测模型可以明显降低网络异常检测的虚警率,提高检测精度。

Network anomaly detection is an important part of the intrusion detection system,however,there are many problems in traditional network anomaly detection methods,such as high false positive rate and the limitation of detecting multiple types of the intrusion actions.A distributed anomaly detection model and the fusion method are proposed based on extended D-S evidence theory.Meanwhile,considering the unreasonableness in the traditional D-S evidence theory when there exist conflictions in the evidences,an extended D-S evidence theory with weights is adopted,and a newly fusion policy is proposed to build an anomaly detection model with multiple classifiers.According to the verification of the KDD99 data set,experiments show that the proposed model and method can obviously reduce the false positve rate,and simultaneously improve the detection rate.