Journal of Computer Applications ›› 2016, Vol. 36 ›› Issue (9): 2438-2441.DOI: 10.11772/j.issn.1001-9081.2016.09.2438

Previous Articles     Next Articles

Frequency self-adjusting algorithm for network instruction detection based on target prediction

YANG Zhongming1, LIANG Benlai2, QIN Yong3, CAI Zhaoquan4   

  1. 1. College of Computer Engineering Technical, Guangdong Institute of Science and Technology, Zhuhai Guangdong 519090, China;
    2. College of Information Engineering, Zhongshan Polytechnic, Zhongshan Guangdong 528404, China;
    3. College of Computer Science, Dongguan University of Technology, Dongguan, Guangdong 523808, China;
    4. Information Technology Center, Huizhou University, Huizhou Guangdong 516007, China
  • Received:2016-02-22 Revised:2016-04-29 Online:2016-09-10 Published:2016-09-08
  • Supported by:
    This work is partially supported by the National Natural Science Foundation of China (61170193), the Science and Technology Project in the Field of Industrial High and New Technology of Guangdong Province (2013B010401036), the Training Program for Outstanding Young Teachers in Guangdong Province (YQ2014187), and the Natural Science Foundation of Guangdong Province (S2013010013432).

基于目标预判的网络入侵检测频率自调整算法

杨忠明1, 梁本来2, 秦勇3, 蔡昭权4   

  1. 1. 广东科学技术职业学院 计算机工程技术学院, 广东 珠海 519090;
    2. 中山职业技术学院 信息工程学院, 广东 中山 528404;
    3. 东莞理工大学 计算机学院, 广东 东莞 523808;
    4. 惠州学院 教育技术中心, 广东 惠州 516007
  • 通讯作者: 杨忠明
  • 作者简介:杨忠明(1980-),男,广东茂名人,副教授,硕士,CCF会员,主要研究方向:信息安全、智能算法;梁本来(1983-),男,山东济宁人,讲师,硕士,主要研究方向:信息安全、网络路由;秦勇(1970-),男,湖南邵阳人,教授,博士,主要研究方向:网络并行路由优化;蔡昭权(1970-),男,广东陆丰人,教授,硕士,CCF会员,主要研究方向:计算机网络。
  • 基金资助:
    国家自然科学基金资助项目(61170193);广东省工业高新技术领域科技计划项目(2013B010401036);广东省高等学校优秀青年教师培养计划项目(YQ2014187);广东省自然科学基金资助项目(s2013010013432);广东省教育厅科技创新项目(2013KJCX0178)。

Abstract: In cluster, it is a conventional method to increase attack efficiency for intruder by attacking the specific target, so it is effective to improve the detection efficiency by scheduling the computing resource contrapuntally. A frequency self-adjusting algorithm for Network Intrusion Detection System (NIDS) based on target prediction, named DFSATP, was proposed. By detecting and analyzing the collected data packets, the data packets sent to potentially attacked targets were marked as high risk data and the other packets were marked as low risk data. The efficiency of NIDS was improved by high frequency detection of high risk data packets and low frequency detection of low risk packets, thus the detection rate of abnormal data was also increased to some extent in limited computing resource circumstances. The simulation results show that the detection rate of abnormal data packets is increased because of the detection frequency adjustment of NIDS by using DFSATP.

Key words: intrusion detection, detection frequency, target pre-detection, detection rate, high risk data, low risk data

摘要: 在集群环境中,入侵者攻击特定目标是提高攻击效率一种常规手段,有针对性地调度计算资源可有效提高检测效率。提出一种基于攻击目标预判的网络入侵检测系统(NIDS)的检测频率自调整算法DFSATP,检测分析采集到的数据,将发往潜在被攻击目标范围的数据列为高危数据,其余数据为低危数据,指引网络入侵检测系统高频检测发往预测目标的高危数据包,低频检测低危数据包,从而提高NIDS的检测效率,保障在有限的计算资源情况下提高异常数据的检出率。模拟实验结果表明,在高速网络环境下,DFSATP对NIDS检测频率的调整,使得异常数据的检出率得到了一定程度的提升。

关键词: 入侵检测, 检测频率, 攻击目标预判, 检出率, 高危数据, 低危数据

CLC Number: