Attack detection system based on decision-making tree

Abstract

An attack detection system based on a decision-making tree comprises a detection data acquisition unit, a detection excavation processor and a classifier, namely, a decision-making tree. The detection data acquisition unit serves as a detection signal inputting end of the attack detection system to acquire to-be-detected data. An output end of the detection data acquisition unit is connected with a signal input end of the detection excavation processor. A signal output end of the detection excavation processor is connected with a signal input of the classifier. A signal output end of the classifier is used for outputting of the attack detection system based on the decision-making tree to display a detection state. According to the system, an association rule method is adopted to establish a normal behavior rule set for detecting abnormal attack; further classification forecasting is performed by the decision-making tree so that false alarm rate is reduced; and according to attack detects based on the decision-making tree, the false alarm rate of an ad hoc network is reduced and capacity of detecting a new intrusion behavior of the system is improved.

Description

technical field [0001] The invention relates to a mobile Ad Hoc network attack detection technology, in particular to an attack detection module with high reliability, specifically an attack detection module based on a decision tree. [0002] Background technique [0003] At present, with the continuous development of network technology and the diversification of intrusion technologies, especially the mobile Ad Hoc network features high activity, rapid structural changes, and structural diversification, the traditional attack detection technology can no longer meet the needs of the system. [0004] Mobile Ad Hoc network attack detection technology is still immature. So far, there is still a lack of a comprehensive and guiding theoretical framework, and a lot of work still needs to be done. Most of the current mobile Ad Hoc network attack detection modules are facing serious problems of insufficient detection capability and high false alarm rate for new attack types. [00...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to propose a decision tree-based attack detection system for the problems of insufficient attack type detection capability and high false alarm rate existing in the existing network attack detection module

Images