智能网络入侵检测系统关键技术研究

《智能网络入侵检测系统关键技术研究》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、国防科学技术大学博士学位论文智能网络入侵检测系统关键技术研究姓名：邹涛申请学位级别：博士专业：信息与通信工程指导教师：沈荣骏;张尔扬20040301国防科学技术大学研究生院学位论文AbstractOneofthemaindevelopingdirectionsoftheIntrusionDetectionSystem(IDS)istouseArtificialIntelligence(AI)techniquestoconstructintelligentIDS．Thisdissertationfocus

2、esonthekeytechniquesofanIntelligentNetworkIntrusionDetectionSystem(INIDS)，whichincludedatacollectionandinformationpresentation，datapreprocess，staticmodelingtechniques．dynamicupdatingtechniquesetc．wealsodescribethedesigningandrealizationofaprototypesystem

3、Theresearchcontentsandtheinnovationofthedissertationareasfollows(11虢analyzetheprincipleofdatacollection，measurementselectionandconstructionfortheINIDS．ⅥrealsoanalyzetheinformationSUfficientconditionfrombothexamplesizeandmeasurementsizeaspects．Thisisthemo

4、stimportantfoundationofconstructingahighperformanceINIDS．(2)weproposeanewdetinitioaofrelevantfeaturesintegratedwithstrongrelevanceandincrementalusefulrelevance．Underthisnewdefinition，wedesignanoveloptimalFeatureSubsetSelection(FSS)algorithmrtamedSRRWbase

5、donthegeneticalgorithmandtheWrapperapproach，ComparedwiththeexistingFSSalgorithms，thenewSRRWalgorithmperformsmuchbetterondatareductionandmodelingaccuracy(3)Inordertoobtainmoreconfidentdetectingresult、wedesignanewdoubleprofilehybriddelectionmethodwhichinte

6、gratesarulebasedclassifierandaNa'fveBayesclassifierItsoutputismoreconfidentthanthetraditionalsingleprofiledetectionmethod(4)Withthestudyofthesystem’sapperceptionabilitytOattacks，weproposeanewstaticmodelingmethodforINIDS：ConceptLevelMisuseDetection(CLMD)．

7、Thisnewmethodresolvestheshortcomingoftraditionalmisusedetectionandcandetectmoreattackinstancesincludingthosebelongtone、,vattacktypesCLMDhasbeenappliedforaChinese口atent(ANewHierarchyIntrusionDetectionSystemBasedonRelevantFeaturesCh】stcring、Chinesepatent：0

8、3137094．2，June18，2003)，(5)Toresolvetheproblemofthesystem’Sinabilityofautomaticupdating，weproposeanevvIntrusionDetectionModelDynamicUpdatingAlgorithm([DMDUA)based012nlulti—viev。andCo．trainingmethodTileIDSapplyingIDMDUAcanup