Data mining based intrusion detection system with self-learning and classified early warning functions

Abstract

The invention provides a data mining based intrusion detection system with self-learning and classified early warning functions. The system comprises a clustering analysis module, an anomaly detection engine, a rule base, a correlation analysis module, a rule generalization module, a rule management module, a log record and a classified early warning module. The data mining based intrusion detection system has the advantages that a data mining technique is applied to intrusion detection, and existing data mining algorithms and network attack characteristics are utilized fully, so that self-learning and classified early warning of the intrusion detection system are realized, detection accuracy and efficiency are improved effectively and substantial economic value and use value are achieved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a data mining-based self-learning hierarchical early warning intrusion detection system. Background technique [0002] The rapid development of information technology and the rapid popularization of the Internet have changed people's work, study and lifestyle. Computer networks have become an important guarantee for the development of an information society and are becoming more and more important in human society. However, due to its openness, interconnection, sharing and other characteristics, the risk of intrusion attacks is becoming more and more serious. In recent years, individual users and enterprises are faced with increasingly complex and proliferating security issues and threats, especially mixed threats such as viruses, worms, Trojan horses, and spam, which have caused significant losses to personal and enterprise information and networks. Whether it ca...

AI Technical Summary

Problems solved by technology

With the continuous improvement of network throughput and transmission speed, its processing performance and detection efficiency are greatly challenged;

[0005] 2) The detection ability is limited by the number and accuracy of the rules in the rule base, that is, only known attacks in the rule base can be detected, but unknown attacks and variants of known attacks cannot be detected, and the adaptive ability is poor

Images