上海交通大学学报

上海交通大学学报（自然版）

• 自动化技术、计算机技术 • 上一篇    下一篇

一种基于图论的入侵检测方法

包振，何迪
  

  1. （上海交通大学 电子工程系， 上海 200240）
  • 收稿日期:2009-12-31 修回日期:1900-01-01 出版日期:2010-09-28 发布日期:2010-09-28

An Intrusion Detection Method Based on Graph Theory

BAO Zhen,HE Di
  

  1. (Department of Electronic Engineering, Shanghai Jiaotong University, Shanghai 200240, China)
  • Received:2009-12-31 Revised:1900-01-01 Online:2010-09-28 Published:2010-09-28

摘要： 在入侵检测系统中引入图论的相关理论并提出了一种基于图论的入侵检测方法，将数据对象之间相似度的关系转换到图论的邻接矩阵中，再将邻接矩阵转换为关联矩阵，以表示数据对象之间的相似关系.利用最速下降法求得最佳的转换矩阵，以完成关联矩阵的块对角矩阵转换而达到数据聚类效果和鉴别出正常数据与入侵攻击数据的类别.同时，利用KDD CUP 1999数据集对系统进行仿真.结果表明，所提出的入侵检测方法能够在很低误警率的情况下达到比模糊C均值聚类算法更高的检测率.

关键词: 入侵检测, 图论, 聚类, 最速下降法

Abstract: An intrusion detection method based on graph theory was proposed. The method introduced the idea of graph theory into intrusion detection system. By transferring the similarity relationship between data objects into the adjacency matrix in the graph, and transferring the adjacency matrix into an association matrix, it could reflect the relationships between data objects clearly. The steepest descent method was used to calculate the optimal transition matrix, and obtain the result of data clustering by transferring the association matrix into a block diagonal matrix, which could identify clusters of normal data and intrusion data. Meanwhile, KDD CUP 1999 dataset was used to simulate. The result shows that the proposed method has a higher detection probability under the condition of low constant false alarm rate compared with fuzzy Cmeans clustering algorithm.

中图分类号: