数据挖掘技术在网络入侵检测中的应用

论述了入侵检测系统的基本概念,针对目前入侵检测系统中存在的问题,提出了一个基于数据挖掘技术的自适应入侵检测系统模型。介绍了该系统模型的基本思想,阐述其结构及主要功能,着重分析了该系统的数据挖掘和检测过程。利用数据挖掘技术自动地从大量数据中提取重要的特征和新的模式,生成有意义的规则并建立检测模型,实现对分布式拒绝服务攻击DDoS(D istrbute Den ial of Service)入侵的检测方法。

Application of data mining techniques to network intrusion detection

The basic concepts of intrusion detection technique are discussed.On the basis of analyzing the existing problems of current intrusion detection systems,an adaptive intrusion detection system model architecture based on data mining is proposed.The basic theory of the system model is introduced,and its structure and main function are expounded.Data mining process is also analyzed.Using data mining,significant features,new patterns and interesting rules can be automatically extracted from volumes of data,and the detection models can be built.Finally,some advantages of the model are briefly presented and show that it is very stable.When simulating DDoS(Distribute Denial of Service)attack on the real environment with bursting packages,the Web server and all connection can work normally.