面向稀有攻击的入侵检测方法

An network intrusion detection method for rare attack

针对现有网络入侵检测方法在识别稀有攻击时检测率低的问题,提出了一种基于联合攻击分类器的入侵检测方法。通过分离数据集获得普通攻击集和稀有攻击集,再基于所获得的子集分别训练攻击分类器来消除普通攻击模式对稀有攻击模式的影响。采用NSL-KDD数据集对该方法进行评估。实验结果表明,此联合攻击分类器在不影响普通攻击检测率的同时,提高了稀有攻击的检测率。

Aiming at the low detection rate of existing networks intrusion detection approaches in recognizing rare attacks. A joint attack classifier is designed for solving the problem. First, original dataset is split into common attack set and rare attack set. Then, those sets are used to train attack classifiers with the purpose of eliminating the influence of common attack patterns on rare attack patterns. The approach has been evaluated by using NSL-KDD dataset and the experimental results show it can gain higher detection rate for rare attacks without influence on common attacks, compared with the results in other existing research works.