本文選題：數(shù)據(jù)挖掘 + 入侵檢測　； 參考：《燕山大學(xué)》2014年碩士論文

【摘要】：入侵檢測系統(tǒng)是重要的網(wǎng)絡(luò)安全主動(dòng)防御工具，通過對(duì)計(jì)算機(jī)網(wǎng)絡(luò)或計(jì)算機(jī)系統(tǒng)中若干關(guān)鍵點(diǎn)收集信息并對(duì)其進(jìn)行分析，，從中發(fā)現(xiàn)網(wǎng)絡(luò)或系統(tǒng)中是否有違反安全策略的行為和被攻擊的跡象。由于入侵行為大多具有相關(guān)性，故對(duì)入侵行為的相關(guān)性分析是入侵檢測的重要手段之一，并廣泛應(yīng)用在入侵檢測系統(tǒng)中。在各種數(shù)據(jù)挖掘方法中，關(guān)聯(lián)規(guī)則挖掘算法是數(shù)據(jù)挖掘中一個(gè)重要的研究內(nèi)容，同時(shí)也是非常適合應(yīng)用于入侵行為的相關(guān)性分析，可以從大量數(shù)據(jù)中發(fā)現(xiàn)正常和異常的行為模式，挖掘出蘊(yùn)含在其中的關(guān)聯(lián)規(guī)則，并利用這些規(guī)則對(duì)原始數(shù)據(jù)進(jìn)行預(yù)處理和規(guī)則匹配，從而達(dá)到檢測入侵行為的目的。所以，通過改進(jìn)關(guān)聯(lián)規(guī)則算法進(jìn)并且將其應(yīng)用于入侵檢測的做法具有重要的現(xiàn)實(shí)意義。 首先，結(jié)合Apriori算法和FP-Growth算法，提出一種基于多維關(guān)聯(lián)頻繁模式樹的MAFP（MultidimensionalAssociation Frequent Pattern）關(guān)聯(lián)規(guī)則挖掘算法，算法采用MAFP-tree結(jié)構(gòu)，對(duì)維和項(xiàng)目集部分分別以MFP-tree(Multidimensional FrequentPattern Tree)和FP-tree作為存儲(chǔ)結(jié)構(gòu)，不僅可以進(jìn)一步壓縮空間，使得用于存儲(chǔ)項(xiàng)目集的臨時(shí)內(nèi)存空間大大減少，而且減少掃描數(shù)據(jù)倉庫的次數(shù)，可以大大提高求解效率，實(shí)現(xiàn)在維信息引導(dǎo)下的高效項(xiàng)集挖掘。 其次，目前數(shù)據(jù)庫越來越龐大，有的甚至達(dá)到TB級(jí)別，在這種情況下，單節(jié)點(diǎn)的串行處理方法就會(huì)出現(xiàn)挖掘效率極其低下的問題。針對(duì)這些問題提出基于Hadoop的并行多維關(guān)聯(lián)規(guī)則算法。該算法的基本思想是將生成頻繁項(xiàng)集和產(chǎn)生關(guān)聯(lián)規(guī)則過程全部交給Master和Slave節(jié)點(diǎn)上的MapReduce共同完成，實(shí)現(xiàn)海量數(shù)據(jù)的分布式存儲(chǔ)和任務(wù)的分布式處理，并且能做到節(jié)點(diǎn)負(fù)載均衡。 最后，通過選取的數(shù)據(jù)樣本集進(jìn)行網(wǎng)絡(luò)入侵檢測，實(shí)驗(yàn)結(jié)果表明，本文所提出的算法在解決相關(guān)問題上是有效可行的，在算法運(yùn)行時(shí)間上要低于同類型的算法，并且在挖掘精度上得到了一定程度的提高，實(shí)現(xiàn)了之前所預(yù)期的研究目標(biāo)。
[Abstract]:Intrusion detection system (IDS) is an important active defense tool for network security. It collects and analyzes some key points in computer network or computer system. Find out if there are security policy violations and signs of attack on the network or system. Because the intrusion behavior has the correlation mostly, the correlation analysis of the intrusion behavior is one of the important means of intrusion detection, and is widely used in the intrusion detection system. Among all kinds of data mining methods, association rules mining algorithm is an important research content in data mining, and it is also very suitable for the correlation analysis of intrusion behavior. Normal and abnormal behavior patterns can be found from a large number of data, association rules contained in them can be mined, and these rules can be used to preprocess and match the original data, so as to detect intrusion behavior. Therefore, it is of great practical significance to improve the association rules algorithm and apply it to intrusion detection. First of all, combining Apriori algorithm and FP-Growth algorithm, a mining algorithm of MAFP(MultidimensionalAssociation Frequent pattern rules based on multi-dimension association frequent pattern tree is proposed. The algorithm adopts MAFP-tree structure and takes MFP-tree(Multidimensional FrequentPattern tree and FP-tree as storage structure for the part of dimension item set, respectively. Not only can the space be further compressed, the temporary memory space for storing itemsets can be greatly reduced, but also the times of scanning data warehouse can be reduced, the efficiency of solving can be greatly improved, and the efficient itemset mining under the guidance of dimensional information can be realized. Secondly, the database is becoming more and more large, some even reach TB level, in this case, the single-node serial processing method will have the problem of extremely low mining efficiency. To solve these problems, a parallel multidimensional association rule algorithm based on Hadoop is proposed. The basic idea of the algorithm is to give the process of generating frequent itemsets and generating association rules to the MapReduce on Master and Slave nodes together to realize the distributed storage of massive data and the distributed processing of tasks and to balance the load of nodes. Finally, the experimental results show that the algorithm proposed in this paper is effective and feasible in solving the related problems, and the running time of the algorithm is lower than that of the same type of algorithm. And the mining accuracy has been improved to a certain extent, and the expected research objectives have been achieved.
【學(xué)位授予單位】：燕山大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.08;TP311.13

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 李雪瑩,劉寶旭,畢學(xué)堯,安德海,許榕生;對(duì)入侵檢測警報(bào)關(guān)聯(lián)分析的研究與實(shí)踐[J];計(jì)算機(jī)工程與應(yīng)用;2003年19期

2 曾志勇;楊呈智;陶冶;;負(fù)載均衡的FP-growth并行算法研究[J];計(jì)算機(jī)工程與應(yīng)用;2010年04期

3 范明;牛常勇;朱琰;;一種挖掘多維關(guān)聯(lián)規(guī)則的有效算法[J];計(jì)算機(jī)科學(xué);2001年11期

4 朱玉;張虹;孔令東;;基于人工免疫的多維關(guān)聯(lián)規(guī)則挖掘及其應(yīng)用研究[J];計(jì)算機(jī)科學(xué);2009年08期

5 高學(xué)東,王文賢,武森;基于數(shù)據(jù)立方體的多維關(guān)聯(lián)規(guī)則的挖掘方法[J];計(jì)算機(jī)工程;2003年14期

6 賀瓊,劉潭仁,郭平;數(shù)據(jù)立方體上多維多層關(guān)聯(lián)規(guī)則挖掘算法[J];計(jì)算機(jī)應(yīng)用;2004年03期

7 倪霖;鄭洪英;;基于聚類和支持向量機(jī)的入侵檢測研究[J];計(jì)算機(jī)應(yīng)用;2007年10期

8 唐少先;蔡文君;;基于無監(jiān)督聚類混合遺傳算法的入侵檢測方法[J];計(jì)算機(jī)應(yīng)用;2008年02期

9 李云;劉學(xué)誠;朱峰;;數(shù)據(jù)挖掘技術(shù)在入侵檢測中的應(yīng)用[J];計(jì)算機(jī)應(yīng)用與軟件;2011年05期

10 肖立中;邵志清;馬漢華;王秀英;劉剛;;網(wǎng)絡(luò)入侵檢測中的自動(dòng)決定聚類數(shù)算法[J];軟件學(xué)報(bào);2008年08期

本文編號(hào)：1991235