基于数据挖掘的协议分析检测模型

针对现有入侵检测系统的不足，根据入侵和正常访问模式的网络数据表现形式的不同以及特定数据分组的出现规律，提出按协议分层的入侵检测模型，并在各个协议层运用不同的数据挖掘方法抽取入侵特征，以达到提高建模的准确性、检测速度和克服人工提取入侵特征的主观性的目的。其中运用的数据挖掘算法主要有关联挖掘、序列挖掘、分类算法和聚类算法。

Protocol analysis detection mode based on data mining

Facing at the shortage in intrusion detection systems, based on the different data forms and special rules that intrusion andnormal access patterns appear. An intrusion detection system modes is put forward according to protocol hiberarchies. In this mode usingdifferent data mining algorithms in different protocol hiberarchies, intrusion features were got to improve the intrusion detection systemspeedand overcome the shortage manual pick-up features. There are several algorithms: association, sequential, classification, clustering.