摘要
针对入侵检测中普遍存在检测率低与误报过高的问题,采用基于多维-隐马尔可夫模型的检测方法和基于Apriori算法的误用检测技术相结合的入侵检测系统(intrusion detection system,IDS)模型。新模型减少了单纯使用某种入侵检测技术时的漏报率和误报率,同时在异常检测模块中采用了隐马尔可夫与简单贝叶斯分类器相结合的新检测方法,用来处理具有时间相关的多维度序列,从而提高系统的安全性和检测效率。使用KDD Cup99数据集进行效果评估证明:新的模型系统检测率为93.12%,而误报率为0.46%,能有效检测网络数据中的入侵行为。
Aimed at low detection rate and high false positive rate problems which are widespread in intrusion detection system,an intrusion detection system（IDS） model was combined by the detection method based on multi-dimensional-hidden Markov model and misuse detection technology based on Apriori algorithm.The false negative rate and false positive rate were reduced by the new model when a simple intrusion detection technology was used,meanwhile,a new detection method which was integrated by Hidden Markov and simple Bayesian classifier in the anomaly detection module was put to use,multi-dimensional sequence which has time correlation was dealt with by it,thereby it enhanced system security and detection efficiency.Result evaluations by using KDD Cup99 data sets show that： detection rate of new model systems is 93.12%,false positive rate is 0.46%,and it can detect intrusion behavior of network data effectively.
出处
《重庆邮电大学学报（自然科学版）》
北大核心
2012年第1期73-77,共5页
Journal of Chongqing University of Posts and Telecommunications(Natural Science Edition)
基金
哈尔滨工程大学硕士研究生培养基金~~
关键词
入侵检测
误用检测
异常行为
intrusion detection
misuse detection
anomaly behavior
