有指导的入侵检测方法研究

基于一种用于混合属性数据的距离定义和改进的最近邻分类方法,提出了一种基于聚类的有指导的入侵检测方法。该方法首先利用一趟聚类算法对训练集进行聚类,再利用数据的标识和少数服从多数的原则将聚类标识为“正常”或“攻击”,以标识的聚类作为分类模型对数据进行分类。理论分析表明提出的检测方法关于数据集大小和属性个数具有近似线性时间复杂度。不同于一般的有指导的入侵检测方法,改进的最近邻方法从理论上保证了该方法对未知入侵有一定的检测能力。在KDDCUP99数据集上的测试结果表明,该方法有高的检测率和低的误报率。     

一种新的半监督聚类入侵检测算法

针对基于监督学习的入侵检测算法所面临的标记数据问题,本文提出了一种基于主动学习的半监督聚类入侵检测算法,利用少量的标记数据,生成用于初始化算法的种子聚类,然后辅助聚类过程,并根据网络数据的特点,将主动学习策略应用于半监督聚类过程中,检测已知和未知攻击。     

基于人工免疫分类器的入侵检测方法

针对入侵检测系统准确率不高和难以检测未知攻击的缺点,将有限资源人工免疫分类器模型算法AIRS应用于入侵检测系统。首先从KDD CUP 99数据集中选取出部分正常数据和攻击数据,对AIRS算法进行训练。然后根据训练得到的模型,对包含已知攻击和未知攻击的不同异常类比的数据集进行测试。实验结果表明:AIRS算法对已知攻击的检测率大大提高,对未知攻击的识别率也有很大的提高。     

一种改进的聚类方法在异常检测中的应用

入侵检测系统是一种积极主动的安全防护技术,它是信息安全保护体系结构中的一个重要组成部分.异常检测是入侵检测的一种方法,因其能够检测出未知的攻击而受到广泛的研究.以基于数据挖掘的异常检测技术为研究内容,以提高异常检测的检测率、降低误报率为目标,以聚类分析为主线,提出了一种改进的聚类检测算法和模型,并进行仿真实验.算法首先去除了数据集中明显的噪声和孤立点,通过分裂聚类、合并聚类以及利用超球体的密度半径确定k个初始聚类中心,以减小初始k值的选取对聚类结果造成的影响,提高异常检测效率,并以此构造入侵检测模型.利用KDD CUP 1999数据集对模型进行实验测试,并对改进算法的效果进行了对比和分析.实验证明,新的检测系统具有良好的性能.     

改进k-means算法的网络数据库入侵检测

提出改进的k-means算法,加入过滤优化功能,通过簇候选集合中攻击簇的数目优化,删除掉非最优聚类数据集合中的攻击数据,生产最优簇,提高后期网络数据库入侵检测的时效性,降低漏检率.实验结果表明,本文的方法能够优化聚类后生成攻击簇的数目的数目,为网络数据量入侵检测提供便利,提高了检测的准确性,降低了漏检率.     

基于相似属性PCA和SVM的网络入侵检测

针对现有网络入侵检测算法泛化能力差与处理大样本数据耗时长的问题,本文提出了基于相似属性主成分分析（PCA）与支持向量机（SVM）的网络入侵检测的方法。采用KDD 1999数据集仿真,原始数据集根据属性间的相似程度分为四类属性集,对四类属性集分别采用PCA进行特征抽取,最后用SVM检验分类的正确率。实验结果表明：与直接采用PCA对全部属性一起降维相比,相似属性PCA的分类降维方法有较短的处理时间,并且有更强的泛化能力,即对未知攻击类型的检测性能。     

基于聚类学习算法的网络入侵检测研究

目前的入侵检测系统存在着在先验知识较少的情况下推广能力差的问题。在入侵检测系统中应用聚类算法,使得入侵检测系统在先验知识少的条件下仍具有良好的推广能力。首先介绍入侵检测研究的发展概况和聚类算法;接着提出了基于聚类算法的入侵检测方法;然后以KDD99这类常用的入侵检测数据为例,讨论了该方法的工作过程;最后将计算机仿真结果进行了分析。通过实验和比较发现,基于聚类学习算法的入侵检测系统能够比较有效地检测真实网络数据中的未知入侵行为。     

主动学习半监督聚类入侵检测算法

针对聚类的入侵检测算法误报率高的问题,提出一种主动学习半监督聚类入侵检测算法.在半监督聚类过程中应用主动学习策略,主动查询网络中未标记数据与标记数据的约束关系,利用少量的标记数据生成正确的样本模型来指导大量的未标记数据聚类,对聚类后仍未能标记的数据采用改进的K-近邻法进一步确定未标记数据的类型,实现对新攻击类型的检测.实验结果表明了算法的可行性及有效性.     

基于两步模糊聚类算法的网络入侵检测应用

模糊C-均值算法(FCM)广泛应用于入侵检测中,在其基础上为了更有效实现入侵数据的划分,应用了基于阴影集的粗糙模糊聚类算法(SRFCM).同时,为提高检测性能提出了一种新的"两步走"方法:首先运用算法将网络数据划分为正常和入侵两种类型,其次再运用算法将入侵数据划分为不同的攻击类型,有效提高了检测性能.本文采用KDDCUP1999数据集进行仿真实验,实验表明"两步走"方法在入侵检测中获得了较高的检测率.     

基于无监督聚类的入侵检测方法

研究了基于无监督聚类的入侵检测算法.算法的基本思想是首先通过比较无类标训练集样本间的距离来生成聚类,并根据正常类比例N来确定异常数据类别,然后再用于真实数据的检测.该方法的优点在于不需要用人工的或其他的方法来对训练集进行分类.实验采用了KDD99的测试数据,结果表明,该方法能够比较有效的检测真实网络数据中的未知入侵行为.     

WSN中数据融合阶段的自适应入侵检测方案

针对基于无线传感网络(WSN)的关键基础设施安全监测问题,提出一种基于数据融合阶段的自适应入侵检测算法。该算法以基于权重的簇化网络结构为基础,利用异常检测子系统和误用检测子系统分别检测已知攻击和未知攻击,然后通过跟踪2个子系统接收操作特征(ROC)和奖惩机制,自动调整转发至2个子系统的融合数据比例,即可实现在数据融合阶段对关键基础设施的自适应入侵检测。仿真分析表明：该算法的准确率和检测率高达99.6%和94.9%以上,与其他经典入侵检测系统相比,可分别至少提高0.5%和10.2%左右。     

一种基于区间时序逻辑模型检测的入侵检测算法

Model checking based on linear temporal logic reduces the false negative rate of misuse detection. However, linear temporal logic formulae cannot be used to describe concurrent attacks and piecewise attacks. So there is still a high rate of false negatives in detecting these complex attack patterns. To solve this problem, we use interval temporal logic formulae to describe concurrent attacks and piecewise attacks. On this basis, we formalize a novel algorithm for intrusion detection based on model checking interval temporal logic. Compared with the method based on model checking linear temporal logic, the new algorithm can find unknown succinct attacks. The simulation results show that the new method can effectively reduce the false negative rate of concurrent attacks and piecewise attacks.     

一种新的DDoS攻击检测算法

为了准确及时的进行DDoS攻击检测,提出了一种新的DDoS攻击检测算法。该算法在基于传统的小波分析检测DDoS攻击的基础上融入了主成分分析法和小波分析法中DDoS检测方法,并根据该算法设计相应的模型和算法来检测 DDoS 攻击,并且引入信息论中的信息熵对源IP地址的分散程度进行度量,根据初始阶段Hurst指数及熵值的变化自适应地设定阈值以检测攻击的发生。实验结果表明,该方法大幅度的提高了DDoS检测的速度。     

Integrated intrusion detection model based on artificial immune

The author puts forward an integrated intrusion detection （ID） model based on artificial immune （IIDAI）, a vaccination strategy based on the significance degree of genes and a method to generate initial memory antibodies with rough set （RS）. IIDAI integrates two kinds of intrusion detection mode： misuse detection and anonymous detection. Misuse detection and anonymous detection are applied to detect the known and the unknown attacks, respectively. On the basis of IIDAI model, an ID algorithm is presented. Simulation shows that the IIDAI has better performance than traditional ID methods in feasibility and effectiveness. It is very prone to achieve a higher convergence rate by using the vaccination strategy. Moreover, RS can remove the redundancy attributes and increase the detection speed. It can also increase detection rate by applying the integrated method.     

ID-based proxy re-signature without pairing

Several new attacks have been identified in CRNs such as primary user emulation, dynamic spectrum access (DSA), and jamming attacks. Such types of attacks can severely impact network performance, specially in terms of the over all achieved network throughput. In response to that, intrusion detection system (IDS) based on anomaly and signature detection is recognized as an effective candidate solution to handle and mitigate these types of attacks. In this paper, we present an intrusion detection system for CRNs (CR-IDS) using the anomaly-based detection (ABD) approach. The proposed ABD algorithm provides the ability to effectively detect the different types of CRNs security attacks. CR-IDS contains different cooperative components to accomplish its desired functionalities which are monitoring, feature generation and selection, rule generation, rule based system, detection module, action module, impact analysis and learning module. Our simulation results show that CR-IDS can detect DSA attacks with high detection rate and very low false negative and false positive probabilities.     

基于深度特征学习的网络流量异常检测方法

针对网络流量异常检测过程中提取的流量特征准确性低、鲁棒性差导致流量攻击检测率低、误报率高等问题,该文结合堆叠降噪自编码器(SDA)和softmax,提出一种基于深度特征学习的网络流量异常检测方法。首先基于粒子群优化算法设计SDA结构两阶段寻优算法:根据流量检测准确率依次对隐藏层层数及每层节点数进行寻优,确定搜索空间中的最优SDA结构,从而提高SDA提取特征的准确性。然后采用小批量梯度下降算法对优化的SDA进行训练,通过最小化含噪数据重构向量与原始输入向量间的差异,提取具有较强鲁棒性的流量特征。最后基于提取的流量特征对softmax进行训练构建异常检测分类器,从而实现对流量攻击的高性能检测。实验结果表明:该文所提方法可根据实验数据及其分类任务动态调整SDA结构,提取的流量特征具有更高的准确性和鲁棒性,流量攻击检测率高、误报率低。     

隐马尔科夫模型检测LDoS攻击方法的研究

针对低速率拒绝服务LDoS （Low-Rate Denial of Service）攻击具有平均速率低、隐蔽性强的特点,提出了一种基于隐马尔科夫模型的LDoS攻击检测方法。首先对网络状态建立隐马尔科夫模型,将归一化累计功率谱密度NCPSD（Normalized Cumulative Power Spectrum Density）方法的检测结果作为隐马尔科夫模型的观测值。利用前向算法得到不同观测值序列在该模型下的相似度作为检测依据。在NS 2中对本检测方法进行测试,实验结果表明本方法能够有效的检测LDoS攻击,与其他方法相比也具有更好的检测性能。通过假设检验得出检测率为99.96%。      

Detection method of LDoS attacks based on combination of ANN ＆ KPCA

Low-rate denial-of-service (LDoS) attack is a new type of attack mode for TCP protocol.Characteristics of low average rate and strong concealment make it difficult for detection by traditional DoS detecting methods.According to characteristics of LDoS attacks,a new LDoS queue future was proposed from the router queue,the kernel principal component analysis (KPCA) method was combined with neural network,and a new method was present to detect LDoS attacks.The method reduced the dimensionality of queue feature via KPCA algorithm and made the reduced dimension data as the inputs of neural network.For the good sell-learning ability,BP neural network could generate a great LDoS attack classifier and this classifier was used to detect the attack.Experiment results show that the proposed approach has the characteristics of effectiveness and low algorithm complexity,which helps the design of high performance router.     

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks.     

Anomaly Detection System in Cloud Environment Using Fuzzy Clustering Based ANN

Cloud computing affords lot of resources and computing facilities through Internet. Cloud systems attract many users with its desirable features. In spite of them, Cloud systems may experience severe security issues. Thus, it is essential to create an Intrusion Detection System (IDS) to detect both insider and outsider attacks with high detection accuracy in cloud environment. This work proposes an anomaly detection system at the hypervisor layer named Hypervisor Detector that uses a hybrid algorithm which is a mixture of Fuzzy C-Means clustering algorithm and Artificial Neural Network (FCM-ANN) to improve the accuracy of the detection system. The proposed system is implemented and compared with Naïve Bayes classifier and Classic ANN algorithm. The DARPA’s KDD cup dataset 1999 is used for experiments. Based on extensive theoretical and performance analysis, it is evident that the proposed system is able to detect the anomalies with high detection accuracy and low false alarm rate even for low frequent attacks thereby outperforming Naïve Bayes classifier and Classic ANN.