基于数据挖掘技术的入侵检测系统的研究

入侵检测技术已经成为网络安全领域的研究热点。本介绍了入侵检测的分类以及应用在入侵检测中的数据挖掘方法，并阐述了构建的基于数据挖掘技术的入侵检测系统的设计与实现。

An Intrusion Detection System Based on Data Mining

It is increasingly necessary to provide network security against theft of information. Intrusion detection system is an emerging and promising security measure, both against unauthorized internal intrusion and as effective protection against hackers in addition to firewall. Section 2 describes the intrusion detection system based on data mining that we propose. Section 2 includes essentially the following topics: (1) the seven items contained in each connect in packet flow; (2) the treatment of packet flow data in order to construct IP (internet protocol) conversation behavior profiles; (3) the storage of IP conversation behavior profiles; (4) the mining and analysis of the behavioral data to discover the appearance of potentially suspicious packet flow data which exhibit IP conversation behavior that is abnormal when checked against stored profiles; (5) the testing of our intrusion detection system when the network it protects is under simulated attack. The results from experiments, as described at the end of section 2, show preliminarily that the system can be used for detecting probing attacks.