摘要
介绍了入侵检测的作用、类型和原理,针对入侵检测系统中由于模式库更新不及时造成的高误报率和漏报率,提出了协同数据挖掘的入侵检测模型.该技术依据关联规则,自动发现事物间联系的特性,利用关联规则自动生成模式库,并针对传统Apriori算法的缺陷引入加权关联规则.实验结果表明,该模型对已有的典型攻击检测率为90%以上.
In this paper we describe the function, types and theory of intrusion detection. Aiming at the problem of high rate of false negatives and false positives of IDS, which are caused by the older pattern library, we propose the intrusion detection model cooperating with data mining. This technique automatically shows the characteristic of the connection among the things according to the association rules and creates pattern library automatically using association rules. And aming at the limitation of traditional arithmetic of Apriori, we integrate association rules with weighted items. The experiments indicate that the rate of accuracy of detection is above 90%, realizing the target of design,
出处
《哈尔滨理工大学学报》
CAS
2006年第2期94-96,共3页
Journal of Harbin University of Science and Technology
基金
黑龙江省自然科学基金资助项目(F0306)
关键词
入侵检测
数据挖掘
关联规则
自动建模
intrusion detection （ID）
data mining
association rules automatically
creating pattern library
