基于可拓集的入侵检测模型

针时入侵行为特征表现的隐蔽性、不确定性和多样性问题,提出一种基于物元模型和可拓集的入侵检测模型.利用多评价特征类物元描述多特征表现的入侵行为,建立每一个评价特征的关联函数并进行运算,得到综合关联函数以建立多特征物元可拓集,作为检测该入侵行为的模型.对于待检测行为,通过计算其与可拓集的综合关联度来判定是否为入侵行为以及异常的程度,不同的综合关联函数能够实现基于多特征融合的不同检测方法,该模型被应用到网络异常流量检测中.

Intrusion detection model based on extensible set

Intrusion behavior is featured with concealment, uncertainty and diversity. An intrusion detection model based on matter element model and extensible set was introduced to meet this trend. An intrusion behavior with multiple performances was described by a class matter element with multi-evaluating features, and for each evaluating feature, a dependent function was constructed. Through a simple arithmetic, the all dependent functions were fused into an integrated dependent function, which was used to establish an extensible set detecting the intrusion behavior. For the behavior to be detected, the integrated dependent degree was calculated, which can determine whether the behavior is intrusion and can also determine abnormal degree , achieving a variety of detection methods based on multi feature fusing. This model was implemented in network traffic anomaly detection.