Real-time intrusion detection method based on data mining

Abstract

The invention relates to a real-time intrusion detection method based on data mining. An ASM (adaptive strategy management) module and an AMM (adaptive model management) module are added into a distributed real-time system framework and used for automatically generating and distributing detection strategies and detection models of an intrusion detection system based on data mining respectively. By the aid of the structure, the problems in terms of automation of related data, automatic generation and distribution of the detection models and the detection strategies, and real-time data evaluation can be solved. A distributed system comprises some components which can be flexibly changed in the system framework to adapt to different environmental changes and meet the demands of users.

Description

Technical field [0001] The present invention is a technical solution for intrusion detection. It mainly applies data mining technology to real -time invasion detection applications, which belongs to the field of computer network security technology. Background technique [0002] With the rapid development of information technology, the risk and opportunities of network invasion have also increased sharply. Design security measures to prevent the resources and data or malicious attacks of unauthorized access system resources and malicious attacks, which has become a very in the current field of cyber security.Important and urgent issues.As an important support technology for information security, the invasion testing technology has developed significantly, and has become an important part of the structure of the security protection system. [0003] Invasion testing refers to the process of discovering and identifying unauthorized interviews or malicious attacks and invasion in a s...

AI Technical Summary

Problems solved by technology

[0005] (1) Lack of effectiveness: Existing rule bases, knowledge bases, and statistical methods are all hand-coded based on expert knowledge. Faced with complex network environments, expert knowledge is often incomplete and inaccurate;

[0006] (2) Lack of adaptability: When writing detection codes, experts generally focus on analyzing known system vulnerabilities or attack modes, and lack detection capabilities for unknown attack methods

[0007] (3) Limited scalability: Because experts design detection models based on experience, such models are often only aimed at a specific detection environment, and the original detection rules and detection models are generally difficult to modify or merge with new ones.

Images