Method and system for intrusion detection

Abstract

The invention discloses a method and a system for intrusion detection. Cluster analysis is carried out on a test sample set through a graphical partition method, then the behavior type of cluster obtained through the cluster analysis on the test sample set is determined by utilizing a training sample set, and thus the determination of the behavior type of the test sample set is realized. Since the determination process of the behavior type of the test sample set does not completely depend on the training sample, contained in a training sample set, owned behavior type, a new behavior type can be found by adopting the scheme provided by the embodiment of the invention.

Description

technical field

[0001] The invention relates to the technical field of intrusion detection, in particular to an intrusion detection method and system. Background technique

[0002] The Internet provides an efficient and convenient new way for resource sharing and information exchange, but at the same time it is also used by intruders who occupy, steal, or even destroy other people's computer information system resources, making information resources in the network face serious threats. security threats. In order to ensure the security of the network information system, people have taken certain measures from many aspects, and these measures together constitute the network security defense system.

[0003] Intrusion Detection (Intrusion Detection) technology is a core technology of network security defense system. It uses some autonomous and intelligent tools to collect and analyze several key points in the computer system or computer network, and detects whether there is a...

Images