基于可视化图形特征的入侵检测方法

An intrusion detection method based on visualization graphical feature

摘要:

入侵检测是保障网络安全的重要措施,网络攻击手段的多样性和隐蔽性不断增强导致入侵检测愈加困难,迫切需要研究新的入侵检测方法。结合可视化技术和k近邻分类算法,提出一种基于图形特征的入侵检测方法。采用信息增益方法对原始特征进行排序选择,并进行雷达图可视化表示,提取雷达图的图形特征构成新的数据集并送入k近邻分类器进行训练和测试。通过KDDCUP99数据集仿真实验表明,该方法不仅能直观显示攻击行为,而且获得较好的攻击检测性能,对DOS攻击的检测率可达97.9%,误报率为1.5%。

Abstract:

Intrusion detection is one of the important measures to guarantee the security of network. The growing diversity and concealment of network attacks lead to the difficult of intrusion detection, which make the research for new intrusion detection method is urgent. Combined with visualization technology and k-Nearest Neighbor classifier, an intrusion detection method based on graphical feature is proposed in this paper. The information gain method is used to rank the original features, and the front features are selected for radar chart visualization presentation. After a new dataset based on the graphical features is generated, k-Nearest Neighbor classifier is applied to train and test it. The results of experiment based on KDDCUP99 dataset show that the proposed method can not only visualize the attacks, but also has really satisfactory performance of intrusion detection, with 97.9% detection rate and 1.4% false positive rate for DOS.