基于行为模式挖掘的网络入侵检测

基于系统模型DMIDS，提出了一种有效防范网络入侵的方法。该方法基于IP包信息挖掘出用户的频繁行为模式，能自动建立正常和异常的用户行为规则库；利用相似性匹配，能实时地检测出已知的和未知的攻击。详细介绍了用户频繁行为模式挖掘算法－－IDSPADE，实验结果表明该算法能够有效地发现多种网络入侵行为。和现有基于知识工程的方法相比，该方法具有更高的智能性和环境适应性。

Network Intrusion Detection Based on Behavior Patterns Mining

An efficient method based on data mining is presented for detecting network intrusion. According to this method, user's behavior patterns are mined from IP packets, and used to build user's behavior rules base automatically. By comparing similarity, the new method can be used to detect known and unknown network attacks in real time. The user's behavior patterns mining algorithm IDSPADE is described in detail, which is the most important part of DMIDS. The experimental results indicate that this algorithm is efficient enough to meet the needs of active detect novel intrusion. Compared with most existing systems by using the pure knowledge engineering approaches, the algorithm is more intelligent and adaptive.