基于流量分析的入侵检测系统研究

An intrusion detection system based on flow analysis

随着网络技术发展,信息系统的安全性日益成为政府、企业及事业部门越来越关注的重大问题,保障信息系统的安全性已经成为迫切的需要.现有的网络安全系统多采用基于规则入侵检测技术,因而误报率较高;本文根据对边检入侵检测系统测量分析的基础上提出基于流量的边检入侵检测系统,通过量化分析来预测入侵和DDOS攻击,从而保证网络的安全性.

Intrusion detection is a focus of current research. Anomaly detection techniques have been devised to address the limitations of misuse detection approaches for intrusion detection with the model of normal behaviors. A Self-Similar is a useful tool to model sequence information, an optimal modeling technique to minimize false-positive error while maximizing detection rate, but too complex and inefficient. This paper proposes an effective flow analysis intrusion detection system that improves the modeling time and performance by only considering the transition flows. Experimental results show that training with the proposed method is significantly faster than the conventional method trained with all data, without loss of detection performance.