摘要： 文中提出了一种具有自学习、自完善功能的入侵监测模型，可发现已知和未知的滥用入侵和异常入侵活动。在提出的模型中，移动Ａｇｅｎｔ将收集到的各个活动监测Ａｇｅｎｔ采集的数据发送给事件序列生成器，事件序列生成器将由此产生的事件序列提交给数据挖掘引擎进行证据发现，检测引擎对发现的证据和已有规则间的相似性进行评估后由决策引擎做最终的裁决，并据此维护规则库和对各个活动监测Ａｇｅｎｔ发出对抗指令。

关键词: 入侵检测, 数据挖掘, 计算机信息安全

Abstract: In this paper we present an intrusion detection system model with the functions of self-learning and self-completing, which can detect the known and novel intrusion activities. In this model, the mobile agent gathers the data collected by the active detection agents and sends it to the event sequence generator. The later preprocess the data and commit the event sequences to data mining engine in order to form the evidence. The detection engine assesses the degree of similarity between the evidence and the rules in rule-lib, then the decision-making engine makes the final adjudication, it also maintains the rule-lib and sends instructions to all active detection agents to deal with various intrusions.

中图分类号: 

• TP393.08