摘要
针对网络异常检测方法对新型入侵提供信息不足的缺点,提出一种面向新型入侵的获取和分类方法.首先,通过异常检测方法捕获入侵,然后利用匹配过滤机制筛除已知入侵,最后将获取的新型入侵作为聚类模块的输入,通过聚类及提出的类别获取算法对新型入侵做进一步分类匹配,从而获得其类别信息.最后,采用KDDCUP99数据集进行实验仿真,结果表明该检测方法具有较好的检测率和较低的误报率,并且该方法对于识别并分类新型入侵是有效的.
In view of less useful information for new intrusions that can be obtained by anomaly detection, a method of the capture and classification of new intrusion is proposed. First, an anomaly intrusion detection meth od is used to find intrusions. Second, pattern matching plays a role in filtering out the known intrusions, and the remaining new intrusions are regarded as the input to clustering module, through which further classification is carried out. As a result, the valid information about its class is obtained. Finally, based on the experiment simu- lation, which uses data set KDDCUP99, the results show that the detection method has a better detection rate and low false alarm rate, and that the method to identify and classify the new intrusions is valid.
出处
《常熟理工学院学报》
2012年第8期103-108,共6页
Journal of Changshu Institute of Technology
关键词
异常检测
分类映射
信息获取
anomaly detection
classification map
information acquisition
