论文标题:基于RBF神经网络的入侵检测系统
Web Application Framework Based Platform Specific Model and Its Mapping Rules
论文作者 尉秀梅
论文导师 杨志敏,论文学位 硕士,论文专业 计算机应用技术
论文单位 山东大学,点击次数 94,论文页数 63页File Size2973k
2005-04-05论文网 http://www.lw23.com/lunwen_93586537/ 入侵检测;人工神经网络;BP;RBF
IDS; ANN; BP; RBF
入侵检测系统(IDS)作为一种积极主动的安全防护技术,提供了对内部攻击、外部攻击和误操作的实时保护,在网络系统受到危害之前,拦截和响应入侵。然而现在入侵检测系统面临着巨大挑战,越来越复杂的计算机网络系统,越来越高明的入侵手段都要求入侵检测技术不断快速发展。 本论文概述了如今入侵检测技术的发展现状,概览了当前的网络攻击类型,分析了传统的入侵检测系统存在的缺点,介绍了常用攻击检测系统的作用、类型和原理。简单介绍了应用于入侵检测系统的新技术,简要说明了人工神经网络的学习方法、工作原理,特别对BP算法和RBF算法进行了比较。 随着新技术的发展,人工神经网络技术开始广泛的运用于入侵检测系统。现在流行的BP(Back Propagation,误差的后向传播)神经网络由于技术成熟,在入侵检测中得到了广泛应用,但其本身所具有的局部极小性限制了检测性能的提高。RBF(Radial Basis Function,径向基函数)网络在逼近能力、分类能力和学习速度方面均优于BP网络,能够有效的解决BP网络所存在的这些问题,提高入侵检测性能和效率。 本文主要构建了一种基于RBF神经网络的入侵检测系统,给出了基本的设计思想和算法,以及样本数据的收集和预处理方法。为使神经网络获得更多的有用信息,在神经网络的输入中包含了单包信息和包序列信息,对单包进行了过滤,使单包信息更加完整;从包序列中提取了很多有价值的信息,与传统的入侵检测相比,有—定的优越性。 将该系统进行了仿真试验,对实验结果进行了客观的比较和分析,发现RBF网络确实比BP网络有优势,尤其是大大加快了训练的速度,提高了检测的效率,实验结果也比较令人满意,漏检率和虚警率都不是很高,而且对新类型的攻击,也有一定的检测效果。因此RBF神经网络在入侵检测方面具有很大的发展空间和应用前景。 本文的创新点是将RBF神经网络用于入侵检测系统,实现对攻击行为的预测,报警。而且在数据预处理时,除了有单包信息之外,还包含了很多从包序列中提取的有价值的信息,提高入侵检测的性能。
As an active security-defense technique, intrusion detection system (IDS) offers real-time protect against interior or exterior attack, and mistaken operation. It can intercept or give response to the intrusion before the network is in invasion. However, nowadays the intrusion detection system is facing great challenges, more and more complicated computer network system and wiser intrusion means requiring the intrusion detection technique to develop rapidly.Summarizeing the actuality of the development of IDS, the present thesis descripts the types of intrusion in the internet and analyzes the shortcoming of traditional IDS. And it introduces the function, types and theory of common IDS. The thesis gives a brief introduction to the new technologies applied into IDS and explains the learning methods and working theories of Artificial Neural Network (ANN), especially the comparison of the learning and detecting capability between BP net and RBF net.ANN has been widely applied to IDS along with the development of new technologies. As a mature technology, BP neural networks have been applied in the field of intrusion detection for several years. However, due to its property limitation of local minimization, it is hard to improve its detection performances. Because RBF (Radial Basis Function) network is better than BP (Back Propagation) network in its property of optimal approximation, classify ability and the rapidity of study, it can improve the detection performances of IDS.This thesis constructs an IDS based on RBF neural network, which gives the basic thinking of design and the arithmetic, the method of collection and beforehand disposal way of the sample data. In order to get more valuable information, we put the single package and serial packages in the input of ANN, filter the single package to make the single package information more integrity and pick up more valuable information from the serial packages. So the IDS based on RBF have more advantage compared with traditional IDS.We have done some emulational examinations to this system. The result indicates that RBF net is more preponderant than BP net. RBF net can particularly expedite the training speed and increase the efficiency of intrusion. The result of examination is satisfactory. The false positive rate is not great, and the detection rate of new kind intrusion is not too low. So the RBF net has wide space of development and foregroundofusein IDS.The innovation of this design is the application of the RBF net into IDS and the realization of the detection and alarm of intrusion. During the forehand disposal of data, we not only deal with the single package information but also pick up more valuable information from the serial packages. So the capability of IDS is improved.Because of the limited time, the system only equalities a filter of intrusion, and adjudicates whether the intrusion exists, but can not point out the real types of the intrusion. The system still needs improvement in the later time.
|
