论文标题:基于自适应策略的入侵检测系统研究
The Algorithm Research of Volume Rendering and System Realization of Meteorology Visualization
论文作者 郭建龙
论文导师 张维明,论文学位 硕士,论文专业 管理科学与工程
论文单位 国防科学技术大学,点击次数 468,论文页数 58页File Size2849k
2002-01-01论文网 http://www.lw23.com/lunwen_392332/ 计算机免疫系统;自适应;入侵检测;机器学习
Computer Immune System,Adaptation,Intrusion Detection,Machine Learning
本文研究的内容是包含在基于人工免疫系统的入侵检测框架中的。计算机免疫系统是模仿人体免疫系统的机理构造出来，包括主IDS(负责生成规则)和从IDS(负责从主IDS接收规则并进行检测)，依靠两者的协作来完成入侵检测的系统。本文的主要内容就是针对于这个框架中的主IDS，研究怎样构造出高效安全的规则。 由于误报情况的存在和为了减少系统的负担，以及称之为基率佯缪问题的存在，针对于主IDS，本文构建了一个自适应入侵检测方法，由主IDS决定系统所处的网络环境的恶劣程度，并向从IDS下达指令转变相应的策略。 本文详细讨论了一个自适应空间的构成和方法。一个完整的自适应空间包含一个条件空间和一个策略空间，文中分析了这两个空间的性质和关系，并根据实际的入侵方式制定了相应的条件空间和策略空间，从而构成了一个完整的系统。 除了对于已知入侵的分析之外，还有很多入侵方式的模式在目前是未知的。为了检测未知入侵的需要，本文还讨论了采取人工智能中机器学习的方法来实现机器制定策略的问题。
The content of this article is base on the artificial immune model of intrusion detection. We developed an IDS based on the artificial immune model. In this model,there exists one primary IDS (It is in charge of rule generating.) and several secondary IDS (They receive the rule form primary IDS and detect the intrusion.). This article set the focus on the primary IDS,and try to make the rule set of the primary IDS.For the exists of false alarm and trying to release the system burden,and for the exist of what we call base-rate fallacy,we try to construct a security adaptation system for the primary IDS. The primary IDS decide the criticality of the network environment,and give the order on switch the detection policy to the secondary IDS.We have a full discussion on the construction and the option of the adaptation space. An adaptation space consists of a condition space and a tactic space. In this paper there is an analysis on the character and relationship between the two kind of spaces. And in the next part,we use the method to construct a real system,with the analysis of several real intrusion mode.We think it impossible to construct the whole tactic automatically,but possible to replace human being in some way. So we turn to the artificial intelligence method. To detect the unknown intrusion,we adopt some method in machine learning to construct the tactic by the computer automatically.
|
