摘要： 提出了基于数据挖掘技术的网络异常检测方案，并给出核心模块的算法实现。首先使用静态关联规则挖掘算法和领域层面挖掘算法刻画系统的网络正常活动简档，然后通过动态关联规则挖掘算法和领域层面挖掘算法输出表征对系统攻击行为的可疑的规则集，这些规则集结合从特征选择模块中提取网络行为特征作为分类器的输入，以进一步降低误报率。在DARAP1998、DARAP1999入侵检测评估数据集上的实验证明了该方法的有效性。

关键词: 入侵检测, 异常检测, 数据挖掘, 审计记录

Abstract: A data mining-based network anomaly detection technique is proposed in this paper, the algorithm implementation of kernel module is also given. Firstly a combination of static mining plus domain level mining is used to profile the normal activity model of network; then, a combination of a dynamic mining algorithm for association rules plus the domain level algorithm, whose output consists of rules that characterize attacks to the system. These rules, along with a set of features extracted by a features selection module are used as the training set for a classifier for the purpose of lowering the false positive rate further. Experiment results on the DARAP 1998 intrusion detection evaluation dataset verifies the effectiveness of this method.

中图分类号: 

• TP393.08