基于数据挖掘和本体的实时入侵检测系统

通过分析现有入侵检测技术,提出了一种建立入侵检测系统的新方法。该方法结合误用检测技术和异常检测技术,利用数据挖掘能高效地从大量的审计数据中挖掘出代表行为特征的频繁模式和本体可以对对象的本质进行描述的特点,并加入相似度以判断是否发生入侵,同时决定是否更新规则本体库。经分析该系统可以有效地提高检测的效率。

Data Mining and Ontology Based Intrusion Detection System in Real-time Environment

Through analyzing the current intrusion detection system, this paper presented a new method of building intrusion detection sys- tem. Combining the misuse detection and anomaly detection technology, and making use of the characteristics of data mining can dig out the multifarious mode that representing the behavior feature from a flood of audit data efficiently and ontology that can describe the genius of the object, the method adds similarity in order to estimate whether the intrusion occur or not, at the same time, decide whether the pattern ontology base can be update or not. The analyzing shows that this system can improve the efficiency of detection.