一种混合入侵检测模型

ONE MIXED INTRUSION DETECTION MODEL

摘要:

为了提高入侵检测模型的准确率，提出一种基于K-均值算法、朴素贝叶斯分类算法和反向传播神经网络的混合入侵检测模型。首先，采用基于分区、无监督式聚类分析的K-均值算法进行数据的聚类处理，得到易于被机器处理和学习的数据集。为了进一步获取必要的数据属性，将聚类处理的结果输入到贝叶斯分类器进行分类。然后，具有较短学习周期的反向传播神经网络负责训练数据分类样本。最后，基于KDD CUP99数据集，对混合入侵检测模型进行了仿真实验，实验结果表明，通过混合入侵检测模型，DoS、U2R、R2L和Probe等入侵数据被精准地检测出。相比其它入侵检测模型，混合入侵检测模型取得了较高的准确率和召回率，以及较低的误报率，具有一定的实用价值。

Abstract:

In order to improve the accuracy of intrusion detection model, one mixed intrusion detection model was proposed in this paper, which combined with K-means algorithm, Naive Bayes algorithm and Back-Propagation neural network. In this work, as a partition-based, unsupervised cluster analysis method, K-means method was firstly applied. The data sets obtained were easily processed and learned by arbitrary machine learning algorithm in this form of clustering. Then, Bayes classifier processes these outcomes as a probability model. In this step, the fit and essential data attributes were achieved. Next, filter data samples learning was implemented by Back Propagation Neural Network, which was able to learn the patterns with less number of training cycles. Finally, the mixed intrusion detection model was validated by experiments on KDD CUP99’s datasets. Attacks as DoS, U2R, R2L and Probe were detected via the mixed intrusion detection model. The simulation experiments results show that the mixed intrusion detection model improved the accuracy and error rate compared with other models as well as the recall rate. Furthermore, this mixed intrusion detection model also demonstrates some value of practical application.