本文選題：入侵檢測　切入點：決策樹　出處：《大連理工大學(xué)》2012年碩士論文　論文類型：學(xué)位論文

【摘要】：隨著計算機網(wǎng)絡(luò)技術(shù)的迅速發(fā)展,人們的工作、學(xué)習(xí)、生活變得越來越離不開計算機網(wǎng)絡(luò)。與此同時,黑客攻擊日益猖獗,網(wǎng)絡(luò)安全問題日趨嚴峻,迫切需要各種網(wǎng)絡(luò)安全技術(shù)來解決入侵攻擊問題。入侵檢測是繼“信息加密”、“防火墻”等傳統(tǒng)安全保護方法之后的新一代安全保障技術(shù)。作為一種主動防御的安全技術(shù),入侵檢測已經(jīng)成為網(wǎng)絡(luò)安全領(lǐng)域研究的熱點,發(fā)展前景廣闊。 針對目前的入侵檢測系統(tǒng)(IDS)準確度不高、自適應(yīng)性差、檢測效率低等問題,本文基于數(shù)據(jù)挖掘技術(shù)進行入侵檢測研究,將分類、聚類、成分分析等多種數(shù)據(jù)挖掘方法綜合應(yīng)用于入侵檢測過程中,以提高入侵檢測系統(tǒng)的性能。 本文首先分析了決策樹方法應(yīng)用于入侵檢測系統(tǒng)的可行性,之后將C4.5決策樹算法作為分類器應(yīng)用于入侵檢測的過程中,并設(shè)計了一個基于決策樹的入侵檢測系統(tǒng)模型,詳細描述了模型中各模塊的功能與設(shè)計。為提高系統(tǒng)性能,在模型中設(shè)計了“樣本選擇”和“特征提取”兩個預(yù)處理過程。 接著對“樣本選擇”和“特征提取”這兩個預(yù)處理過程進行深入研究。分析了常用的幾種樣本選擇方法的不足,提出一種基于聚類的樣本選擇方法。該方法先對各類訓(xùn)練數(shù)據(jù)分別進行聚類分析,達到細分數(shù)據(jù)的目的,在此基礎(chǔ)上通過不同的策略選擇每個簇的邊界樣本和典型樣本。通過樣本選擇,提高了分類器的檢測效率和泛化能力。接下來介紹了核主成分分析(KPCA)的基本原理,將其應(yīng)用到入侵檢測系統(tǒng)中,實現(xiàn)了對樣本的特征提取,并比較其與主成分分析(PCA)的特征提取效果。針對KPCA存在的不足,提出一種用遺傳算法改進KPCA的方法。通過遺傳算法對提取出的特征進行優(yōu)化選擇,進一步提高了入侵檢測系統(tǒng)的性能。 最后在KDDCUP99數(shù)據(jù)集上的仿真實驗,證明了本文各個研究的先進性。
[Abstract]:With the rapid development of computer network technology, people's work, study and life become more and more inseparable from computer network. There is an urgent need for various network security technologies to solve intrusion attacks. Intrusion detection is a new generation of security technology after traditional security protection methods such as "information encryption" and "firewall". Intrusion detection has become a hot topic in the field of network security and has a bright future. Aiming at the problems of low accuracy, poor adaptability and low detection efficiency in current intrusion Detection system (IDS), this paper studies intrusion detection based on data mining technology, classifying, clustering, and so on. Component analysis and other data mining methods are applied to the intrusion detection process to improve the performance of intrusion detection system. This paper first analyzes the feasibility of applying decision tree method to intrusion detection system, then applies C4.5 decision tree algorithm to intrusion detection process as classifier, and designs an intrusion detection system model based on decision tree. The function and design of each module in the model are described in detail. In order to improve the system performance, two preprocessing processes of "sample selection" and "feature extraction" are designed in the model. Then, the two preprocessing processes of "sample selection" and "feature extraction" are deeply studied, and the shortcomings of several commonly used methods of sample selection are analyzed. A method of sample selection based on clustering is proposed. On this basis, the boundary samples and typical samples of each cluster are selected by different strategies. The detection efficiency and generalization ability of the classifier are improved by sample selection. Then the basic principle of KPCA-based kernel principal component analysis (KPCA) is introduced. It is applied to the intrusion detection system, and the feature extraction of the sample is realized, and the feature extraction effect is compared with that of the principal component analysis (PCA). In this paper, a genetic algorithm (GA) is proposed to improve the performance of intrusion detection system (IDS) by optimizing and selecting the extracted features by genetic algorithm (GA). Finally, the simulation experiment on KDDCUP99 data set proves the advancement of each research in this paper.
【學(xué)位授予單位】：大連理工大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2012
【分類號】：TP393.08;TP311.13

【引證文獻】

相關(guān)期刊論文 前1條

1 盧揚;;組合聚類算法在異常檢測中的應(yīng)用研究[J];電腦知識與技術(shù);2012年33期

，

本文編號：1586285