应用机器学习制定的入侵检测专家系统规则集

Constructing an Expert System Rule of Intrusion Detection Using Machine Learning

随着数据量的增长,从海量的网络流量中分析出非正常的网络连接变得越来越困难,计算机在检测中所起的作用越来越突出,其中的一种方法是构建专家系统,计算机根据规则对可能的非正常网络连接进行匹配,这种方法中目前最重要的就是规则集的动态制定以及修改。该文使用机器学习技术来制定和修改这些规则。在研究过程中使用了遗传算法和决策树来完成这项工作,并描述了这两种方法在网络入侵检测中的具体应用。

With the data growing, differentiating anomalous network connection from vast amounts of network traffic becomes more and more difficult. Computers become more and more important in intrusion detection. One of the detection methods is to construct an expert system. The computer matches the possibly anomalous network connection with rules. The most important thing in this method is the construction and modification dynamically of the rules. We use machine learning technology to construct and modify these rules. To complete this job, we adopt the genetic algorithms and decision trees. This article describes the use of these two methods in network intrusion detection.