Apriori-KNN算法的警报过滤机制的入侵检测系统

Intrusion Detection System Based on Apriori-KNN Algorithm for Alarm Filtering Mechanism

针对基于特征的网络入侵检测系统(NIDS)高误报率的弊端,提出了利用数据挖掘技术来减少误报的方法.首先对基于特征的NIDS的正常警报模式进行建模,使用Apriori-KNN算法对NIDS持续输出的警报进行过滤,然后对真正的警报输出进行处理,从而减少入侵检测系统的误报率.采用DARPA数据集和真实数据进行测试,结果证明,在不改变现有配置的情况下,本方法可有效地降低NIDS的误报率.

For signature-based network intrusion detection systems（NIDSs）which suffering from the problem of high false alarm rate,we propose a new method of using data mining technology to reduce the number of false alarms. In this paper,we first model the normal alarm mode of signature-based NIDS and use the false alarm filter based on the Apriori-KNN algorithm to filter the alarm that is continuously output by signature-based NIDS,and output a real alarm and process it. The experiments base on the DARPA data set and the real data,it is proved that this method can effectively reduce the false alarm rate of NIDS without changing the existing configuration.