基于正常簡檔聚類的自適應(yīng)異常檢測技術(shù)研究.pdf

1、中南大學(xué)碩士學(xué)位論文基于正常簡檔聚類的自適應(yīng)異常檢測技術(shù)研究姓名：李斌申請學(xué)位級別：碩士專業(yè)：計算機應(yīng)用技術(shù)指導(dǎo)教師：劉衛(wèi)國20090501ABSTRACTAsadynamicsecuritytechnologyintrusiondetectionprovidesreal—timeprotectionagainstinternalandexternalattacksaswellasmisoperationinterceptsandres

2、pondstointrusivebehaviorsbeforeattacksexertanyharmtothenetworkAtpresent，theanomalydetectionresearchwhichhasputforwardabatchofdetectiontechnologiesforthesecurityfield，whiletherealestillmanyproblemspendingtogetsolvedThisth

3、esisadoptstheideaofanomalydetectionandselectsclusteringalgorithm，andthenpresentsanadaptiveanomalydetectionmodelbasedonaclusterofnormalprofilesBasedonthatmodel，ahybridintrusiondetectionsystemisrealizedThisthesisconcludesm

4、aincontentsasfollows：1Analyzestheresearchmethodologyofanomalydetectiontechnologiesindetailed，describesthenormalprofileinanomalydetectiontechnologies，sumsuptheprocessesofadaptiveintrusiondetectionAtthesametime，analyzesand

5、comparesapplicationsofclusteringalgorithminintrusiondetection2ProposesanadaptiveanomalydetectionmodelbasedonnormalprofilebyclusteringItselectesnormaldatarecordstoestablishanormalprofilethroughkmeansclusteringalgorithm，de

6、tectesnetworkdatarecordsaccordingtothenormalprofile，andupdatesthenormalprofilewithdetectednormaldatarecordsExperimentswiththeKDDcup99datasetindicatesthatthedetectionsystemcanadapttodatachangetrendsandthedetectionrategets

7、abetterimprovement，whilemaintainingaverylowrateoffalsealarms3Realizesahybridintrusiondetectionsystem，whichincorporatedtheadvantagesofbothmisusedetectionandanomalydetectionTheexperimentshowedthatdetectionratereaches8437％，