Dm can automatically extract the signatures and features without human interference . it can be used in unknown attack detection and decrease the dependence of es on the detection rule 而利用數(shù)據(jù)挖掘技術(shù)能夠自動提取模式的特點(diǎn)進(jìn)行異常檢測,能夠自動發(fā)現(xiàn)未知模式的入侵,降低了專家系統(tǒng)對知識庫中規(guī)則的依賴性。
Two new kinds of detection - filtering mechanism are proposed in this paper . they are distributed attack detection - filtering mechanism ( dadf ) and local attack detection - filtering mechanism ( ladf ) 在此基礎(chǔ)上,本文提出了兩種新的攻擊檢測?過濾機(jī)制,即:分布式攻擊檢測?過濾( dadf )機(jī)制和針對tcp洪流攻擊的本地檢測?過濾( ladf )機(jī)制。
There seem to be no substantial improvement in anti - ddos research on attack preventing , detecting & retorting yet , nor did any effective or nicety method appear to predict the ddos attack in time . ddos attack detection and defending is one of the frontiers in the field of network security 但是,目前全球?qū)dos攻擊進(jìn)行防范、檢測和反擊的研究工作沒有實(shí)質(zhì)性的重大突破,沒有能準(zhǔn)確及時預(yù)測ddos攻擊發(fā)生的有效方法, ddos攻擊的檢測與防護(hù)是當(dāng)前網(wǎng)絡(luò)安全領(lǐng)域的重要前沿。
Normal behavior and anomaly are distinguished on the basis of observed datum such as network flows and audit records of host . when a training sample set is unlabelled and unbalanced , attack detection is treated as outlier detection or density estimation of samples and one - class svm of hypersphere can be utilized to solve it . when a training sample set is labelled and unbalanced so that the class with small size will reach a much high error rate of classification , a weighted svm algorithm , i 針對訓(xùn)練樣本是未標(biāo)定的不均衡數(shù)據(jù)集的情況,把攻擊檢測問題視為一個孤立點(diǎn)發(fā)現(xiàn)或樣本密度估計(jì)問題,采用了超球面上的one - classsvm算法來處理這類問題;針對有標(biāo)定的不均衡數(shù)據(jù)集對于數(shù)目較少的那類樣本分類錯誤率較高的情況,引入了加權(quán)svm算法-雙v - svm算法來進(jìn)行異常檢測;進(jìn)一步,基于1998darpa入侵檢測評估數(shù)據(jù)源,把兩分類svm算法推廣至多分類svm算法,并做了多分類svm算法性能比較實(shí)驗(yàn)。
In the face of the increasingly complicated threat of network environment , this paper focuses on the study of theories and key technologies of information security operation about network adversary , operation architecture , attack detection , attack prevention , attack deception and vulnerability analysis . the purpose of the researches is to explore new methods for information security assurance so that we can have the initiative on information security 而對日益復(fù)雜網(wǎng)絡(luò)環(huán)境威脅,本文就網(wǎng)絡(luò)敵手模型、對抗體系、攻擊檢測、攻擊阻斷、攻擊欺騙以及脆弱性分析等信息安全對抗理論和關(guān)鍵技術(shù)進(jìn)行研究。其目的在于探索新型的信息安傘保障方法,以掌握信息安全對抗主動權(quán)。