面向高速数据流的新型异常入侵检测技术研究

Intrusion Detection Based on data mining is one of the most important methods of network security protection. However, the traditional data mining algorithm for static data sets cannot overcome the phenomenon of concept drift, and cannot respond to the changing of information in the process of data transmission. In addition, there are many problems, such as real-time data acquisition and high dimensional data processing, which restrict the development of real-time intrusion detection in high-speed networks.. This project launches a series of related research about the anomaly intrusion detection technology for high speed data stream. The main research content and objectives are: 1) Improving the performance of Hoeffding tree classification algorithm in intrusion detection; 2) Selecting excellent individuals by improved clonal immune algorithm to reduce data dimension and detect anomaly behaviors; 3) Proposing a novel data stream clustering algorithm for overcoming the phenomenon of concept drift and detecting unknown attack behaviors; 4) Designing an real-time intrusion detection framework for high speed data stream through the integration and optimization of these technologies.

结合数据挖掘技术的入侵检测是当前网络安全防护的重要手段之一。然而，传统的面向静态数据集的数据挖掘算法无法克服概念漂移现象，不能及时响应数据传输过程中信息的变化。此外，在高速网络下存在数据实时获取、高维数据处理等问题，这些难点制约着高速网络下实时入侵检测的发展。. 本项目围绕高速数据流下的异常入侵检测展开一系列相关研究，主要的研究内容和目标为：1)通过对Hoeffding树算法进行改进，实现对数据的实时处理，降低时空开销；2)通过克隆免疫算法选择优秀个体实现数据降维和异常检测；3)提出一种数据流聚类算法，克服概念漂移现象，并实现对未知类型的攻击行为的检测；4)通过对以上技术的集成和优化，设计面向高速数据流的实时入侵检测框架。

本项目围绕高速数据流的异常入侵检测进行了深入研究，主要涉及数据包抓取、数据降维、分类学习、聚类分析等。对高速数据流进行数据清洗和数据降维等预处理，利用数据流分类和聚类等算法，同时考虑加密数据流的异常检测情形，最终实现整个异常检测模型的研究。该项目产生了如下的一系列研究成果，主要集中在：基于增量流形的数据流降维特征选择；基于增量聚类的数据流异常入侵检测；基于集成学习的概念漂移数据流分类；面向分布式漂移数据流集成分类；基于边缘计算的数据流异常检测；面向加密数据流的异常检测等。