基于误用检测与异常行为检测的整合模型

针对入侵检测中普遍存在检测率低与误报过高的问题,采用基于多维-隐马尔可夫模型的检测方法和基于Apriori算法的误用检测技术相结合的入侵检测系统(intrusion detection system,IDS)模型.新模型减少了单纯使用某种入侵检测技术时的漏报率和误报率,同时在异常检测模块中采用了隐马尔可夫与简单贝叶斯分...

An integrated model based on misuse detection and anomaly behavior detection

Aimed at low detection rate and high false positive rate problems which are widespread in intrusion detection system, an intrusion detection system (IDS) model was combined by the detection method based on multi-dimensional-hidden Markov model and misuse detection technology based on Apriori algorithm. The false negative rate and false positive rate were reduced by the new model when a simple intrusion detection technology was used, meanwhile, a new detection method which was integrated by Hidden Markov and simple Bayesian classifier in the anomaly detection module was put to use, multi-dimensional sequence which has time correlation was dealt with by it, thereby it enhanced system security and detection efficiency. Result evaluations by using KDD Cup99 data sets show that: detection rate of new model systems is 93.12%, false positive rate is 0.46%, and it can detect intrusion behavior of network data effectively.