下一代互连网络入侵检测系统研究

Study on Intrusion Detection System for Next-generation Internet

漏报和误报问题是下一代互联网入侵检测系统亟需解决的问题。传统基于特征的误用检测方法不能适应下一代互联网高带宽环境,无法准确、完整地识别攻击事件,造成检测准确性不高。为了解决上述问题,采用异常检测技术,快速采集网络数据,按"等级"分析、精简数据,以数据挖掘思路,基于非线性支持向量机分类检测数据,准确提取网络正常行为模式,合理设置阈值,保证入侵检测自适应性与准确性。仿真结果表明,下一代互联网入侵检测原型系统能够有效地检测出入侵或异常行为,显著降低漏报率和误报率,有助于保证网络安全。

False negatives and false positives problems are critical for the next - generation Internet intrusion de- tection systems. Nevertheless, traditional signature - based misuse detection methods can not adapt to the high - bandwidth environment of next - generation Internet, and are unable to accurately and completely identify attacks, which results in low detection accuracy. In order to solve the above problems, an anomal detection method was intro- duced in this paper, which then employs fast network data capture technology, analyzes and streamlines data by ＂lev- el＂. Meanwhile, on the basis of data mining method, a non - linear support vector machine was employed to classify data and accurately extract normal network behavior patterns, reasonably set threshold, so as to ensure the self - a- daptive and accuracy of intrusion detection. The simulation results of opposite experiment show that the intrusion de- tection system for next - generation Interuet effectively can enhance the ability to detect various unknown attacks and si^nificantlv reduced the false nositives rate and false negative rate.