| 基于免疫原理与粗糙集理论的入侵检测方法 |
| |
| 引用本文： | 蒋世忠,杨进,张英. 基于免疫原理与粗糙集理论的入侵检测方法[J]. 计算机应用, 2006, 26(5): 1077-1080 |
| |
| 作者姓名： | 蒋世忠 杨进 张英 |
| |
| 作者单位： | 广东药学院,计算机系,广东,广州,510006;广东药学院,计算机系,广东,广州,510006;广东药学院,计算机系,广东,广州,510006 |
| |
| 摘 要： | 针对目前基于进程系统调用的入侵检测方法中存在的问题，提出了一种基于免疫原理与粗糙集理论的入侵检测方法。该方法在对系统调用序列中的循环序列进行置换的基础上，借助于粗糙集理论，提取出一个简单的最小预测规则模型；同时融合免疫原理的有关机制，在检测模型中加入对已知入侵的快速检测引擎。同其他方法相比,该方法不需要完备的进程系统调用数据,而且得到的规则简单，更适用于实时检测。实验结果表明,该方法的检测效果优于同类的其他方法。
|
| 关 键 词： | 入侵检测 粗糙集理论 免疫原理 系统调用 循环序列 规则 快速检测 |
| 文章编号： | 1001-9081（2006）05-1077-04 |
| 收稿时间： | 2005-11-10 |
| 修稿时间： | 2005-11-102006-01-10 |
An Intrusion Detection Model Based on Immune and Rough Sets Theory |
| |
| JIANG Shi-zhong,YANG Jin,ZHANG Ying. An Intrusion Detection Model Based on Immune and Rough Sets Theory[J]. Journal of Computer Applications, 2006, 26(5): 1077-1080 |
| |
| Authors: | JIANG Shi-zhong YANG Jin ZHANG Ying |
| |
| Affiliation: | Department of Computer, Guangdong Pharmaceutical University; Guangzhou Guangclong 510006, China |
| |
| Abstract: | Intrusion detection system has become the research hotspot because it can provide dynamic protection for computer system. Aiming at the problems existed in actual methods or models of intrusion detection, an effective method for intrusion detection based on immune theory and rough sets theory was presented in this paper. The circular sequences of system call sequences generated during the normal execution of a process is replaced by circular body, then, a little data is extracted from normal system call sequences, and is transformed to decisive table, afterward, the decisive table is reduced and the simplest rules that present normal behavior mode is extracted from rcduct by rough sets theory. These rules can be used to detect anomalous behavior. In order to realize the quick detection of known intrusion, an engine of quick detection inspired by immune system theory was presented in this paper. Compared with other methods in the literature, the method presented in this paper is not only able to extract a set of effective detection rules with the minimum size from part of records of system call sequences, but also can dctect the known intrusion quickly. Experiments show that this method in this paper is better than other methods based on system call. |
| |
| Keywords: | intrusion detection rough sets theory immune theory system call circular sequence rule quick detection |
| 本文献已被 CNKI 维普 万方数据 等数据库收录！ |
| 点击此处可从《计算机应用》浏览原始摘要信息 |
|
点击此处可从《计算机应用》下载全文 |
|
