导　　师： 秦勇

学科专业： 081203

授予学位： 硕士

作　　者： ;

机构地区： 江苏科技大学

摘　　要： 近年来,随着网络的迅速发展,网络安全问题日益严重。传统的网络安全防护技术和入侵检测技术已经不能检测越来越复杂的网络攻击。如何提取网络入侵特征,以及检测新型的网络攻击成了当前入侵检测研究的主要方向。而数据挖掘技术能够很好的对海量数据进行分析并从中获取隐藏在数据背后的规则特征,把数据挖掘技术应用到入侵检测系统中,可以得到很好的效果。 本文首先对入侵检测技术的概念、分类,并详细描述其研究技术,描述了当前入侵检测技术发展的趋势及存在的问题。其次本文描述了关联规则,指出了其优缺点。之后本文就当前入侵检测系统的性能评估作了介绍,并给出了基于回报期望模型的入侵检测评估方法,并通过实验证明了其可行性,然后就此提出了反馈控制系统,该系统可以自动优化规则库。本文的重点是给出了基于snort//bro的分布式反馈控制入侵检测防护系统,该系统弥补了当前流行的snort入侵检测系统只能检测到网络底层的入侵,对于网络高层的入侵形式无法检测的缺点。同时实现了双规则库的应用,该应用有效地提高了关联规则的准确率。 最后,对本文的工作进行了总结,指出了本文所作的努力和工作,同时指出了本文的不足。 本文所作的努力和工作:给出了基于回报期望模型的入侵检测性能评估模型和基于snort//bro的分布式反馈控制入侵检测防护系统。 With the rapid development of the network in recent years, network security is becoming increasingly serious. Traditional network security technologies and intrusion detection technology have been unable to detect increasingly sophisticated network attacks. How to extract the characteristics of network intrusion, as well as how to identify a new type of network attack has become the main direction study of the current intrusion detection. Data mining technology is not only good at analyzing massive data, but also extracting the characteristics rules which hide behind the data. Data mining technology applies to network intrusion detection has more important value of results. Firstly,the concept, classification and research techniques of intrusion detection are described in detail in this paper, which presents current development trends and problems of intrusion detection. Furthermore, association rule is described which advantages and disadvantages are presented in this paper. And then, the performance evaluation of current intrusion detection system is introduced and the intrusion detection evaluation method based on newsboy model is proposed that the experiment proved its feasibility,and feedback control system is proposed which can optimize the rule base automatically. This paper focuses on that the distributed feedback control intrusion detection prevention system based on snort//bro is proposed, which makes up the shortcomings of snort of only detecting the invasion of the underlying network without high-levels. While achieving the application of double-rule base , which effectively improves the accuracy of association rules. Finally, the work is summarized and the efforts and innovation and deficiencies of this paper are pointed out. The efforts and innovations have made in this paper: improved association rule algorithm based on concept lattice is proposed; performance evaluation model of intrusion detection based on newsboy model and distributed feedback control intrusion detection prevention system based on snort//bro are proposed.

关 键 词： 入侵检测 关联规则 回报期望模型

分 类 号： [TP393.08]

领　　域： [自动化与计算机技术] [自动化与计算机技术]