摘要
分析了现有的入侵检测方法,设计了基于自适应谐振理论的网络入侵检测系统(ARTNIDS).它采用了一种全新的行为表示方法,即根据网络数据包结构定义网络行为特征变量;利用改进的自适应谐振理论算法,提高了学习效率,使丢包率由15%左右降低到10%以下,实现了无监督和在线实时学习;提出的类似Hamming距离的检测算法,使误报率低于10%.依上述方法构造的原型系统经实验证明能高效地检测出局域网内的入侵行为.
A network intrusion detection system based on adaptive resonance theory （ARTNIDS） is put forward. It detects network intrusions by using anomaly-based detection method. Since the heads of network datagrams include almost all the control information and all datagrams can be caught through an efficient method, the description of network behavior relies upon the datagrams. The advantage of adaptive resonance theory ensures that ARTNIDS can study in real time and in an unsupervised way, which is essential to anomaly-based detection. The modified adaptive resonance theory algorithm improves the efficiency of studying and the datagram missing rate has been reduced from 15% to 10%. A similar Hamming distance method is adopted in the detection, which is effective in reducing false positive errors and false negative errors; the error rate is less than 10%. The experimental results show that the intrusion detection system based on adaptive resonance theory can detect intrusion behavior in local area network accurately.
出处
《计算机学报》
EI
CSCD
北大核心
2005年第11期1882-1889,共8页
Chinese Journal of Computers
基金
吉林省自然科学基金(20030522-2)
振兴东北老工业基地科技公关项目(04-02GG158)资助
