摘要： 入侵检测系统是用来检测网络入侵行为的工具。入侵检测系统的关键在于其安全模式规则的准确性。网络系统中存在大量的日志审计数据,在这些日志审计数据中含有许多与安全有关的信息。入侵检测系统可以从日志审计数据中提取安全模式规则。但由于这些日志审计数据量非常庞大,因此采用数据挖掘技术从中进行安全模式规则的提取。研究了如何在入侵检测中对系统日志审计信息进行数据挖掘,提出了全套的步骤,并重点论述了采用轴属性对日志审计信息进行特征提取。

关键词: 入侵检测, 日志审计, 数据挖掘

Abstract: IDS (Intrusion Detection System) is a tool to detect the network intrusion actions. The key of IDS is the accuracy of the security mode rules. In network system there is a large amount of log audit data which contain much information related to security. So IDS can extract security mode rules from the log audit data. However, as the amount of the log audit date is too large, we can apply data mining technology into security mode rule extraction. This paper studies how to make data mining to system log audit information in IDS, provides the whole steps, and stresses using axis attribute to make character extraction to log audit information.

中图分类号: 

• TP393.08