本文關(guān)鍵詞： 入侵檢測 支持向量數(shù)據(jù)描述 貝葉斯參數(shù)估計(jì) 單類模型 概率模型　出處：《西北農(nóng)林科技大學(xué)》2014年碩士論文　論文類型：學(xué)位論文

【摘要】：入侵檢測作為新一代網(wǎng)絡(luò)信息安全技術(shù)，經(jīng)過多年的發(fā)展，已被廣泛應(yīng)用。而如何提高檢測算法的有效性，進(jìn)一步降低誤警率和漏報(bào)率，還需更加深入的研究。在入侵檢測的研究中，應(yīng)用模式識(shí)別的方法是目前的一個(gè)重要方向；并且，考慮到入侵檢測數(shù)據(jù)的隨機(jī)性和不平衡性，單類概率模型更加符合該問題。 考慮入侵檢測數(shù)據(jù)的不平衡性，隨機(jī)性，本文將支持向量數(shù)據(jù)描述模型及其改進(jìn)貝葉斯數(shù)據(jù)描述模型應(yīng)用于入侵檢測問題中。同時(shí)，采用主成份分析相關(guān)技術(shù)對(duì)其進(jìn)行等方差處理，使之更加符合模型的假設(shè)，從而實(shí)現(xiàn)模型的改進(jìn)。其主要內(nèi)容如下： （1）考慮入侵檢測數(shù)據(jù)的不平衡性，支持向量數(shù)據(jù)描述這一單類模型被應(yīng)用于入侵檢測中；考慮入侵檢測數(shù)據(jù)的隨機(jī)性，以及前后的關(guān)聯(lián)性，，本文對(duì)基于支持向量數(shù)據(jù)描述模型采用貝葉斯參數(shù)估計(jì)改進(jìn)的貝葉斯數(shù)據(jù)描述模型進(jìn)行了研究。實(shí)驗(yàn)結(jié)果表明，這兩個(gè)模型的檢測準(zhǔn)確率達(dá)到了80%，從而說明這兩個(gè)模型應(yīng)用于入侵檢測問題中的可行性；而且，對(duì)于不同的數(shù)據(jù)，貝葉斯數(shù)據(jù)描述模型較支持向量數(shù)據(jù)描述模型表現(xiàn)出了更高的穩(wěn)定性，從而證明概率模型應(yīng)用于入侵檢測問題中的優(yōu)越性。 （2）由于以上兩個(gè)單類模型均基于數(shù)據(jù)的超球分布假設(shè)，所以本文考慮采用主成份分析技術(shù)，對(duì)入侵檢測訓(xùn)練數(shù)據(jù)在各個(gè)方向上做等方差處理，使數(shù)據(jù)呈現(xiàn)超球分布，從而更加符合模型假設(shè)，最終實(shí)現(xiàn)模型的優(yōu)化。同時(shí)，在確定最終的分類閾值時(shí)，考慮存在負(fù)例樣本的情況下，采用支持向量機(jī)方法對(duì)其訓(xùn)練，從而消除原始試驗(yàn)性方法的主觀性�；谝陨蟽煞矫�，最終得到了本文改進(jìn)的概率模型。 （3）為了測試本文改進(jìn)的模型在入侵檢測問題的應(yīng)用效果，基于標(biāo)準(zhǔn)入侵檢測數(shù)據(jù)集，設(shè)計(jì)相關(guān)實(shí)驗(yàn)。實(shí)驗(yàn)結(jié)果表明，通過基于主成份分析技術(shù)的等方差處理改進(jìn)后，其平均檢測率達(dá)到了87.46%，有接近10%的提高；同時(shí)，將改進(jìn)的概率模型與其他傳統(tǒng)模型進(jìn)行比較，發(fā)現(xiàn)其檢測效果已超越部分二分類模型。由以上結(jié)果可得，本文改進(jìn)的模型應(yīng)用于入侵檢測問題中具有良好的效果，入侵檢測率有較大的提高。
[Abstract]:As a new generation of network information security technology, intrusion detection has been widely used after years of development. However, how to improve the effectiveness of detection algorithm and further reduce the false alarm rate and false alarm rate, In the research of intrusion detection, the application of pattern recognition is an important direction, and considering the randomness and imbalance of intrusion detection data, the single-class probabilistic model is more consistent with this problem. Considering the imbalance and randomness of intrusion detection data, this paper applies the support vector data description model and its improved Bayesian data description model to the intrusion detection problem. The principal component analysis (PCA) technique is used to treat the model with equal variance to make it more consistent with the assumptions of the model, thus the improvement of the model is realized. The main contents are as follows:. 1) considering the imbalance of intrusion detection data, the support vector data description model is applied to intrusion detection, considering the randomness of intrusion detection data and the correlation between them. In this paper, the Bayesian data description model based on support vector data description model using Bayesian parameter estimation is studied. The experimental results show that, The detection accuracy of the two models is 80%, which shows the feasibility of applying the two models to the intrusion detection problem; moreover, for different data, Bayesian data description model is more stable than support vector data description model, which proves the superiority of probabilistic model in intrusion detection. 2) since the above two single-class models are based on the supposition of hypersphere distribution of data, this paper considers the use of principal component analysis (PCA) technology to deal with the same variance in all directions of the intrusion detection training data, so that the data present hypersphere distribution. This method is more consistent with the hypothesis of the model, and finally realizes the optimization of the model. At the same time, when determining the final classification threshold, considering the existence of negative samples, support vector machine (SVM) is used to train the model. Therefore, the subjectivity of the original experimental method is eliminated. Based on the above two aspects, the improved probabilistic model is obtained. In order to test the application effect of the improved model in the intrusion detection problem, the experiment is designed based on the standard intrusion detection data set. The experimental results show that the method is improved by the equal-variance processing based on principal component analysis (PCA). The average detection rate has reached 87.46%, with an increase of nearly 10%. At the same time, by comparing the improved probability model with other traditional models, it is found that the detection effect of the improved probability model has exceeded that of the partial two-classification model. The improved model has a good effect in intrusion detection, and the detection rate is greatly improved.
【學(xué)位授予單位】：西北農(nóng)林科技大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.08

【相似文獻(xiàn)】

相關(guān)期刊論文 前10條

1 吳柱;孫睿;許騰;;搜潛發(fā)現(xiàn)概率模型探討[J];指揮控制與仿真;2010年05期

2 白玉昭;梁久禎;;基于概率模型的主題爬蟲的研究和實(shí)現(xiàn)[J];計(jì)算機(jī)工程與科學(xué);2013年01期

3 王行剛;流水線計(jì)算機(jī)性能分析的概率模型方法[J];計(jì)算機(jī)學(xué)報(bào);1980年01期

4 丁定浩;任務(wù)成功概率模型的正確表述[J];系統(tǒng)工程與電子技術(shù);1990年01期

5 畢凌燕;王騰宇;左文明;;基于概率模型的微博熱點(diǎn)主題識(shí)別實(shí)證研究[J];情報(bào)理論與實(shí)踐;2014年02期

6 連曉峰;竇麗華;陳杰;;基于概率模型的2維全局地圖建立方法[J];計(jì)算機(jī)工程與應(yīng)用;2008年02期

7 柴變芳;賈彩燕;于劍;傅s

本文編號(hào)：1535644