Network intrusion detection system and method based on data mining

Abstract

The invention relates to a network intrusion detection system and a method based on data mining. The system comprises a data packet capturing module, a data packet analyzing module, a fragment recombination module, a data mining module, a protocol analyzing module, an alarm responding module and a rule analyzing module. The invention effectively combines data mining technology and protocol analyzing technology, thereby improving the accuracy and the reliability of detection; and simultaneously, the data mining technology is used for processing mass data, thereby realizing real-time response.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a data mining-based network intrusion detection system and method. Background technique [0002] With the rapid development of the network, informatization has penetrated into all aspects of daily life. However, in the process of this rapid development, accompanied by the rapid increase of hacker attacks and the complexity and diversification of attack methods, network security problems have emerged one after another, which has seriously threatened the information platform we rely on for survival. The current simple firewall technology can no longer prevent network intrusion, and the intrusion detection system has been widely used as the main network security technology at present. As a proactive security protection technology, intrusion detection can not only detect intrusions from outside the network, but also supervise the activities of users inside the network, prov...

AI Technical Summary

Problems solved by technology

In recent years, with the emergence of high-speed network technologies such as ATM, Gigabit Ethernet, and G-bit fiber optic networks, the amount of data and information in the network has increased exponentially, causing more and more problems with the above-mentioned simple protocol analysis technology. , including: all data packets must be restored and interpreted, and the massive data generated in the network cannot be processed in a timely manner, resulting in a large number of packet loss, continuous occupation of system resources and low efficiency, and the protocol analysis technology can only target a single Fast, real-time attack detection of data packets, but powerless against intentional attacks and large-scale distributed coordinated attacks. In addition, pure protocol analysis technology does not have auditing functions, which also limits the application of protocol analysis technology

Images