基于Agent和数据挖掘的自适应入侵检测系统

入侵检测系统是网络安全保护体系中的一个重要组成部分,目前大多数入侵检测系统不能适应网络环境的变化,即不具备自适应性.针对这种情况,提出了一种入侵检测系统的自适应策略,该自适应策略由条件空间和策略空间构成,条件空间用来描述网络环境,策略空间用来描述采用的策略.对于条件空间中的某一具体的环境状态,在策略空间存在唯一的策略与之对应.在构建自适应策略的基础上,利用Agent和数据挖掘技术,设计了一个自适应入侵检测系统.模拟实验表明了该自适应策略的有效性.

Adaptive Intrusion Detection System Based on Agent and Data Mining

Intrusion detection system is an essential component of network security protection mechanisms. Most intrusion detection system can not adapt the variation of network environment. Aiming at this problem, an adaptive strategy that composed of condition space and strategy space is proposed. The condition space describes the network environment and the strategy space describes the strategy. There is an exclusive strategy corresponds to a certain environment state in condition space. On the base of the adaptive strategy, an adaptive intrusion detection system based on agent and data mining is designed. The simulation experiments indicate that the adaptive strategy is effective.