Incremental intrusion detection method fusing rough set theory and DS evidence theory

Abstract

The invention relates to an incremental intrusion detection method fusing a rough set theory and a DS evidence theory, and belongs to the network information security field. Aiming at the problems that a detection system cannot satisfy a high speed network real-time detection demand and the detection precision is not high, the method uses a rough set theory to pre-treat a network data stream so as to reduce redundant data, and improves the detection speed. A misuse rule set is extracted from a reduced data set, most attack types are identified through a pattern matching mode, and furthermore the misuse detection is realized. The method employs a misuse detection module, an abnormal detection module, and an incremental unit. The abnormal detection module is realized based on the DS evidence theory and used for detecting attack types not included in a misuse rule base. The incremental unit is used for improving the misuse rule base and updating a built network normal behavior profile in real time. The incremental intrusion detection method fusing the rough set theory and the DS evidence theory improves the detection efficiency and the detection precision of the detection system, and especially for newly arisen attack types.

Description

technical field [0001] The invention belongs to the technical field of computer network information security, and relates to an incremental intrusion detection method combining rough sets and DS evidence theory. Background technique [0002] With the rapid development of computer networks and the wide application of network technology in people's lives, people's daily life is increasingly inseparable from the network, so people pay more and more attention to network security. With the continuous development of hacking technology and the upgrading of various network viruses, only relying on firewalls, encryption and other technologies can no longer meet the needs of network security. Intrusion Detection System (Intrusion Detection System, 1DS), as the last line of defense to protect network security, has gradually attracted people's attention. The intrusion detection system collects the information of key nodes in the host and network, and judges whether the host or network ...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the object of the present invention is to provide an incremental intrusion detection method that combines rough sets and DS evidence theory, which integrates misuse detection technology and anomaly detection technology, overcomes the defect of using a single technology, and improves Improve the detection accuracy and detection efficiency of the detection system; and realize the incremental learning function of the detection system, so that the misuse rule base and the normal behavior profile of the network can be improved and updated in real time with the dynamic changes of the network

Images