基于数据流的网络入侵实时检测框架

doi:10.11772/j.issn.1001-9081.2015.02.0416

计算机应用 ›› 2015, Vol. 35 ›› Issue (2): 416-419.DOI: 10.11772/j.issn.1001-9081.2015.02.0416

基于数据流的网络入侵实时检测框架

李艳红^1,2, 李德玉^1,2, 崔梦天³, 李华^1,4

1. 山西大学计算机与信息技术学院, 太原 030006;
2. 计算智能与中文信息处理教育部重点实验室(山西大学), 太原 030006;
3. 西南民族大学计算机科学与技术学院, 成都 610041;
4. 石家庄铁道大学数理系, 石家庄 050043

收稿日期:2014-09-18 修回日期:2014-11-12 出版日期:2015-02-10 发布日期:2015-02-12
通讯作者: 李德玉
作者简介:李艳红(1977-),女,山西临汾人,讲师,博士研究生,主要研究方向:数据挖掘、机器学习; 李德玉(1965-),男,山西曲沃人,教授,博士,CCF会员,主要研究方向:智能计算、数据挖掘; 崔梦天(1972-),女,内蒙古乌兰浩特人,教授,博士,主要研究方向:可信软件、优化理论和算法; 李华(1978-),女,河北鹿泉人,讲师,博士研究生,主要研究方向:粒计算、数据挖掘。
基金资助:
国家自然科学基金资助项目(61272095,61175067,61303091,61379019,61403238);山西省自然科学基金资助项目(2012061015);山西省科技攻关项目(20110321027-02);山西省回国留学人员科研项目(2013-014)。

Real-time detection framework for network intrusion based on data stream

LI Yanhong^1,2, LI Deyu^1,2, CUI Mengtian³, LI Hua^1,4

1. School of Computer and Information Technology, Shanxi University, Taiyuan Shanxi 030006, China;
2. Key Laboratory of Computational Intelligence and Chinese Information Processing of Ministry of Education, Shanxi University, Taiyuan Shanxi 030006, China;
3. School of Computer Science and Technology, Southwest University for Nationalities, Chengdu Sichuan 610041, China;
4. Department of Mathematics and Physics, Shijiazhuang Tiedao University, Shijiazhuang Hebei 050043, China

Received:2014-09-18 Revised:2014-11-12 Online:2015-02-10 Published:2015-02-12

摘要/Abstract

摘要：

针对计算机网络访问请求具有实时到达以及动态变化的特点,为了实时检测网络入侵,并且适应网络访问数据的动态变化,提出一个基于数据流的网络入侵实时检测框架。首先,将误用检测模式与异常检测模式相结合,通过初始聚类建立由正常模式和异常模式构成的知识库;其次,采用数据点与数据簇之间的不相似性来度量网络访问数据与正常模式和异常模式的相似性,从而判定网络访问数据的合法性;最后,当网络访问数据流发生演化时,通过重新聚类来更新知识库以反映网络访问的最近状态。在入侵检测数据集KDDCup99上进行实验,当初始聚类的样本数为10000,缓冲区聚类的样本数为10000,调节系数为0.9时,召回率达到91.92%,误报率达到0.58%,接近传统非实时检测模式的结果,但整个学习和检测过程只需扫描网络访问数据一次,并引入了知识库的更新机制,在入侵检测的实时性和适应性方面更具有优势。

关键词: 数据流, 入侵检测, 聚类, 知识库, 信息熵

Abstract:

The access request for computer network has the characteristics of real-time and dynamic change. In order to detect network intrusion in real time and be adapted to the dynamic change of network access data, a real-time detection framework for network intrusion was proposed based on data stream. First of all, misuse detection model and anomaly detection model were combined. A knowledge base was established by the initial clustering which was made up of normal patterns and abnormal patterns. Secondly, the similarity between network access data and normal pattern and abnormal pattern was measured using the dissimilarity between data point and data cluster, and the legitimacy of network access data was determined. Finally, when network access data stream evolved, the knowledge base was updated by reclustering to reflect the state of network access. Experiments on intrusion detection dataset KDDCup99 show that, when initial clustering samples are 10000, clustering samples in buffer are 10000, adjustment coefficient is 0.9, the proposed framework achieves a recall rate of 91.92% and a false positive rate of 0.58%. It approaches the result of the traditional non-real-time detection model, but the whole process of learning and detection only scans network access data once. With the introduction of knowledge base update mechanism, the proposed framework is more advantageous in the real-time performance and adaptability of intrusion detection.

Key words: data stream, intrusion detection, clustering, knowledge base, information entropy

中图分类号:

TP301.6

李艳红, 李德玉, 崔梦天, 李华. 基于数据流的网络入侵实时检测框架[J]. 计算机应用, 2015, 35(2): 416-419.

LI Yanhong, LI Deyu, CUI Mengtian, LI Hua. Real-time detection framework for network intrusion based on data stream[J]. Journal of Computer Applications, 2015, 35(2): 416-419.

参考文献

[1] GOVINDARAJAN M, CHANDRASEKARAN R M. Intrusion detection using neural based hybrid classification methods [J]. Computer Networks,2011,55(8):1662-1671.
[2] WANG H, CHEN H, LIU S. Intrusion detection system based on improved naive Bayesian algorithm [J]. Computer Science, 2014, 41(4):111-115,119. (王辉,陈泓予,刘淑芬. 基于改进朴素贝叶斯算法的入侵检测系统[J].计算机科学,2014, 41(4): 111-115, 119.)
[3] TAN A, CHEN H, WU B. Network intrusion intelligent detection algorithm based on AdaBoost [J].Computer Science, 2014, 41(2): 197-200. (谭爱平,陈浩,吴伯桥. 基于SVM的网络入侵检测集成学习算法[J].计算机科学,2014,41(2):197-200.)
[4] LIU Y,TIAN D,YU X, et al. Large-scale network intrusion detection algorithm based on distributed learning [J]. Journal of Software,2008,19(4):993-1003. (刘衍珩,田大新,余雪岗,等.基于分布式学习的大规模网络入侵检测算法[J]. 软件学报,2008,19(4):993-1003.)
[5] YASAMI Y, KHORSANDI S, MOZAFFARI S P, et al. An unsupervised network anomaly detection approach by k-Means clustering & ID3 algorithms [C]// ISCC 2008: Proceedings of the 2008 IEEE Symposium on Computers and Communications. Piscataway: IEEE, 2008: 398-403.
[6] DARTIQUE C, JANG H I, ZENG W. A new data-mining based approach for network intrusion detection [C]// CNSR '09: Proceedings of the Seventh Annual Communication Networks and Services Research Conference. Piscataway: IEEE, 2009: 372-377.
[7] [CM(27]LEE W, STOLFO S J, MOK K W. A data mining framework for building intrusion detection models [C]// Proceedings of the 1999 IEEE Symposium on Security and Privacy. Washington, DC: IEEE Computer Society, 1999: 120-132.
[8] [JP2]ESTAN C, SAVAGE S, VARGHESE G. Automatically inferring patterns of resource consumption in network traffic [C]// SIGCOMM '03: Proceedings of the 2003 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. New York: ACM, 2003: 137-148.
[9] YU Y, GUO S, HUANG H. Anomaly intrusion detection based on data stream [J]. Computer Science, 2007, 34(5): 66-71,114. (俞研,郭山清,黄皓.基于数据流的异常入侵检测[J].计算机科学,2007,34(5):66-71,114.)
[10] WEI X, HUANG H, TIAN S. An online adaptive network anomaly detection system model and algorithm [J]. Journal of Computer Research and Development, 2010, 47(3): 485-492. (魏小涛,黄厚宽,田盛丰.在线自适应网络异常检测系统模型与算法[J].计算机研究与发展,2010,47(3):485-492.)
[11] HUANG Z. Extensions to the k-Means algorithm for clustering large data sets with categorical values [J]. Data Mining and Knowledge Discovery, 1998, 2(3): 283-304.
[12] COVER T, THOMAS J. Elements of information theory [M]. 2nd ed. Hoboken: John Wiley & Sons, 2006: 13-30.
[13] CHEN K, LIU L. "Best K": critical clustering structures in categorical datasets [J]. Knowledge and Information Systems, 2009, 20 (1): 1-33.
[14] FRANK A, ASUNCION A. UCI. Machine Learning Repository [DB/OL]. [2014-08-19]. http://archive.ics.uci.edu/ml.

[1]	张师鹏, 李永忠, 杜祥通. 基于半监督学习和三支决策的入侵检测模型[J]. 计算机应用, 2021, 41(9): 2602-2608.
[2]	陈恒恒, 倪志伟, 朱旭辉, 金媛媛, 陈千. 基于聚类分析的差分隐私高维数据发布方法[J]. 计算机应用, 2021, 41(9): 2578-2585.
[3]	曾祥银, 郑伯川, 刘丹. 基于深度卷积神经网络和聚类的左右轨道线检测[J]. 计算机应用, 2021, 41(8): 2324-2329.
[4]	祝承, 赵晓琦, 赵丽萍, 焦玉宏, 朱亚飞, 陈建英, 周伟, 谭颖. 基于谱聚类半监督特征选择的功能磁共振成像数据分类[J]. 计算机应用, 2021, 41(8): 2288-2293.
[5]	尹春勇, 张帼杰. 面向分布式漂移数据流的集成分类模型[J]. 计算机应用, 2021, 41(7): 1947-1955.
[6]	王月, 江逸茗, 兰巨龙. 基于改进三元组网络和K近邻算法的入侵检测[J]. 计算机应用, 2021, 41(7): 1996-2002.
[7]	王垚, 孙国梓. 基于聚类和实例硬度的入侵检测过采样方法[J]. 计算机应用, 2021, 41(6): 1709-1714.
[8]	戴嫣然, 戴国庆, 袁玉波. 基于肤色学习的多人脸前景抽取方法[J]. 计算机应用, 2021, 41(6): 1659-1666.
[9]	马建红, 曹文斌, 刘元刚, 夏爽. 基于功效特征的专利聚类方法[J]. 计算机应用, 2021, 41(5): 1361-1366.
[10]	王治和, 常筱卿, 杜辉. 基于万有引力的自适应近邻传播聚类算法[J]. 计算机应用, 2021, 41(5): 1337-1342.
[11]	郭帅, 苏旸. 基于数据流的加密流量分类方法[J]. 计算机应用, 2021, 41(5): 1386-1391.
[12]	张全龙, 王怀彬. 基于膨胀卷积和门控循环单元组合的入侵检测模型[J]. 计算机应用, 2021, 41(5): 1372-1377.
[13]	李国荣, 冶继民, 甄远婷. 基于新的鲁棒相似性度量的时间序列聚类[J]. 计算机应用, 2021, 41(5): 1343-1347.
[14]	任晓奎, 刘鹏飞, 陶志勇, 刘影, 白立春. 基于单快拍信号到达角估计算法的室内入侵检测[J]. 计算机应用, 2021, 41(4): 1153-1159.
[15]	李杏峰, 黄玉清, 任珍文, 李毅红. 基于自适应邻域的鲁棒多视图聚类算法[J]. 计算机应用, 2021, 41(4): 1093-1099.

基于数据流的网络入侵实时检测框架

Real-time detection framework for network intrusion based on data stream

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics