基于数据挖掘的网络入侵检测技术研究

现有NIDS的检测知识一般由手工编写,其难度和工作量都较大.将数据挖掘技术应用于网络入侵检测,在Snort的基础上构建了基于数据挖掘的网络入侵检测系统模型.重点设计和实现了基于K-Means算法的异常检测引擎和聚类分析模块,以及基于Apriori算法的关联分析器.实验结果表明,聚类分析模块能够自动建立网络正常行为模型,并用于异常检测,其关联分析器能够自动挖掘出新的入侵检测规则.

Research on network intrusion detection technology based on data mining

The detection knowledge of current NIDS is written by hand, it means much difficulty and a lot of work. Applying data mining techniques to the network intrusion detection, a snort-based NIDS architecture is given. The abnormal detection engine, the cluster analysis module based on K-means algorithm and the association analyzer based on Apriori algorithm are discussed. Experimental results show that the cluster analysis module can automatically build the models of network normal activity and these models can be used in abnormal detection, while its association analyzer can automatically construct new intrusion detection rules.