基于粗糙集和概念格的入侵检测研究
详细信息    本馆镜像全文|  推荐本文 |  |   获取CNKI官网全文
摘要
随着社会网络化程度的增加,安全性隐患日益明显地开始暴露出来,近年来入侵事件的数目已成指数速度增长。入侵检测系统作为计算机安全防御体系的一个重要组成部分正越来越受到人们重视。
     入侵检测是对(网络)系统的运行状态进行监视,发现各种攻击企图、攻击行为或者攻击结果,以保证系统资源的机密性、完整性与可用性。一般地,根据数据分析方法(检测方法)的不同,可以将入侵检测分为异常检测模型与滥用检测模型两种。
     本文通过对训练数据进行学习,得到正常行为与异常行为的规则集,建立了一个基于规则分类判决的入侵检测模型系统,并通过实验验证了此系统的可用性。基于规则分类判决的入侵检测模型系统优点是:如果提取的规则侧重于正常行为,则可得到正常行为的规则集,以构造异常检测模型;若关注的是异常行为,可形成关于入侵行为的特征集,然后可以监视网络,查找入侵行为(滥用检测)。
     模型关键在于决策规则的获取,即通过对训练数据进行学习,得到正常行为与异常行为的规则集。由于粗糙集理论提供了一整套比较成熟的在样本数据集中寻找和发现数据属性之间关系的方法,能更好地描述从有限样本中反映出来的属性之间关系的本质特征,在我们的模型中综合运用了粗糙集与概念格、信息论的有关思想,先采用条件熵的方法对属性进行约简。然后又将概念格和变精度粗糙集相结合,提出了决策规则格的概念,并在构造算法中采用了三种剪枝策略,得到β-下近似决策规则格。最后从此决策规则格中提取出相应的β-一致的决策规则。
     实验表明,我们提取出的决策规则有了极大的简化,规则的适应性更强。
引文
[Beaubouef and Petty, 1993] Beaubouef T, Petry F E. A Rough Set Model for Relational Databases. Ziarko W P(Ed.) Proc. of RSFD'93, Springer-Verlag, 100-107
    [Beaubouef et. al., 1998] Beaubouef, T., Petty, F.E. and Agora, G.. Information-theoretic measures of uncertainty for rough sets and rough relational database. J. Information Sciences, 109, 185-195
    [Bjorvand A T., 1998] Bjorvand A T. 'Rough Enough' - A system supporting the Rough Sets Approach. http://home.sn.no/~torvill
    [Browne et. al., 1998] Browne C, Duntsch, I., Gediga, G.. IRIS revisited -A comparison of discriminant and enhanced rough set data analysis, in L.Polkowski, A.Skowron (eds.): Rough sets in knowledge discovery, Physica-Verlag
    [Carpineto et. al., 1996] Carpineto, C. and Romano, G.. A lattice conceptual clustering system and its applicaton to browsing retrieval, machine learning, 24, 95-122
    [Carpineto et. al., 1993] Carpineto C, and Romano G. Galois: an order-theoretic approach to conceptual clustering. In: Utgoff P ed. Proceedings of ICML-93, Amherst :Elsevier, 33~40
    [Carpineto et. al., 2001] Carpineto, C., Romano, G., D'Adamo, R Inferring dependencies from relations :a conceptual clustering approach, to appear in Computational Intelligence.
    [Chan C-C., 1998] Chan C-C. A rough set approach to attribute generalization in data mining. information sciences, 107, 169-176
    [Cole R, et. al., 1999] Cole R, Eklund P W. Sealability In formal concept analysis. Computational Intelligence, 15(1), 1999
    [Corbett D, et. al., 1996] Corbett D, Burrow A L. Knowledge reuse in SEED exploiting conceptual graphs. International Conference on Conceptual Graphs(ICCS'96), Sydney, 56-60
    [Deogun J S, et. al., 1998] Deogun J S, Raghavan V V, Sever H. Association Mining and Formal Concept analysis, in: Proceedings of RSDMGrC'98, Duke
    [Dubois D, et. al., 1992] Dubois D, Prade H. Putting Rough Sets and Fuzzy Sets Together. In: R. Slowinski (Ed.) Intelligent Decision Support: Handbook of Applications and Advances of the Rough Set Theory. Dordrecht: Kluwer Academic Publishers,
    [Duntsch et. al., 1998] Duntsch, I. and Gediga, G. Uncertainty measures of rough set prediction, Artificial Intelligence, 106, 109-307
    [Duntsch I, et. al., 1996] Duntsch I, Gediga, G., Jutting, A. GROBIAN- An engine for rough set data analysis, Proc. of the 1st int. conf. on practical aspects of knowledge management,
    
    Basel, 1996
    [Eklund et. al., 1998] Eklund P W, Martin P. WWW indexation and document navigation using conceptual structures. 2nd IEEE Conference on Intelligent Information Processing Systems (ICIPS '98), IEEE Press, 217-221
    [G.Michal et. al., 1994] G.Michal, S.Jacek. RSL- The Rough Set Library version 2.0, ICS Research Report, Warsaw university of technology
    [Ganter et. al., 1999] Ganter B, Wille R. Formal concept analysis: mathematical foundations. Berlin: Springer.
    [Godin et. al., 1994] Godin R, Missaoui R. An incremental concept formation approach for learning from databases. Theoretical Computer science, 133:387~419
    [Godin et. al., 1996] Godin R, Mineau G, Missaoui R, St-Germain M, Faraj N. Applying concept formation methods to software reuse. International Journal of Software Engineering and Knowledge Engineering, 5(1), 119-142.
    [Godin et. al., 1997] Godin R, Mili H, Mineau G W, Missaui R, Arfi A. Design of class hierarchies based on concept (Gaiois) lattices. Theory and application of object systems, 4(2), 117-134
    [Godin, 1995] Godin R. Incremental concept formation algorithm based on Galois (concept) lattices. Computational Intelligence, 11 (2), 246-267
    [Greco et. al., 1998] Greco S, Matarazzo, B., Slowinski, R. On joint use of indiscemiblity, Similarity and Dominance in Rough Approximation of Decision Classes, Research report RA-012/98, Poznan University of Technology
    [Greco et. al., 1998] Greco S, Matarazzo B, Slowinksi R. Fuzzy Measure Technique for Rough Set analysis. 6th Euro. Congress Intelligent Techniques&soft computing, Germany, 99-103
    [Greco et. al., 1998] Greco S, Matarazzo, B., Slowinski, R. the use of rough sets and fuzzy sets in MCDM, in T.Gal, T.Hanne, T.Stewort(eds.) Advances in Multiple criteria decision making", chapter 14, Kluwer Acdemic Publisher, Boston
    [Grzymala-Busse et. al., 1998] Grzymala-Busse J W, Zou X. Classification strategies using certain and possible rules. 1st int. conf. Rough sets and Current Trends in computing, Poland, 37-44
    [Ho T B., 1995] Ho T B. An approach to concept formation based on formal concept analysis. IEICE Trans. Information and Systems, E78-D(5):553-559
    [Ho T B., 1997] Ho T B. Incremental conceptual clustering in the framework of Galois lattice, in H.Lu, H.Motoda and H.Liu Eds. KDD: Techniques and Applications. World Scientific, 49-64
    [Hu X., 1995] Hu X. Knowledge discovery in databases: an attribute-oriented rough set approach.
    
    Doctoral dissertation, University of regina, Canada
    [Hu, K. et. al., 1999] Hu, K., Lu, Y. and Shi, C. Incremental association rule mining: a concept lattice approach, The Third Pacific Asia International Conference on Knowledge discovery and data mining(pakdd99), Beijing, China
    [Hu, K. et. al., 1999] Hu, K., Lu, Y., Zhou, L. and Shi, C. Integrating association and classification rule mining: a concept lattice framework, The Seventh International Workshop on Rough Sets, Fuzzy Sets, Data Mining, and Granular-Soft Computing (RSFDGrC'99), Yamaguchi, Japan
    [J.Deogun, et. al., 1998] J.Deogun, S.Choubey, V.Raghavan, H.Sever. Feature selection and effective classifiers, Journal of ASIS 49, 5,403-414
    [J.W.Guan et. al., 1998] J.W.Guan, D.A.Bell. Rough computational methods for information systems, Artificial intellignence, 105.77-103
    [Jelonek et. al., 1995] Jelonek J, Krawiec K, Slowinski R. Rough Set Reduction of Attributes and their Domains for Neural Networks. Computational Intelligence, 11(2): 339-347
    [Kent et. al., 1995] Kent R E, Bowman C M. Digital Libraries, Conceptual knowledge systems and the Nebula interface. Technical report, University of Arkansas.
    [Kent et. al., 1996] Kent, R.E. Rough Concept Analysis: A synthesis of rough set and formal concept analysis, Fundamenta Informaticae, 27(1996): 169-181
    [Kohavi et. al., 1994] Kohavi R, Frasca B. Useful Feature subsets and Rough set reducts. Third international workshop on Rough Sets and Soft computing (RSSC'94), 1994
    [Kryszkiewicz M., 1998] Kryszkiewicz M. Rough set approach to incomplete information systems, information sciences, 112:39-49
    [Lenarcik et. al., 1998] Lenarcik A, Piasta Z. Rough classifiers sensitive to costs varying from object to object. 1st int. conf. Rough sets and Current Trends in computing, Poland, 222-230
    [Lin T Y., 1996] Lin T Y. Rough set theory in very large databases. Proceedings of IMACS Multiconference, volume 2, Lille, 1996, 942-947
    [Lin, T.Y., 1996] Lin, T.Y. Neighborhood systems - a qualitative theory for fuzzy and rough sets. In: Wang, P.P.(Ed.), Advances in machine intelligence and soft computing 4, 23-30
    [Lingras et. al., 1998] Lingras P J, Yao, Y.Y. Data Mining using extensions of the rough Set model, Journal of the american society for information science, 1998, 49(5):415-422
    [Lingras et. al., 1999] Lingras P, Davies C. Rough Genetic algorithms. In Zhong N, Skowron A eds. Proc.7th Intl.Wksp on RSFD, Springer, 38-46
    [Liu Q., 1996] Liu Q. Accuracy Operator Rough Logic and its Resolution Reasoning. In: Proceedings of 5th Workshop on RSFD'96. Toyko, 55-60
    
    
    [Mollestad et. al., 1999] Mollestad T, Komorowski J. A rough set framework for mining prepositional default rules, in Pal S K, Skowron A eds. Rough Fuzzy hybridization. Springer, 233-262
    [Neuss et. al., 1999] Neuss C, Kent R E. Conceptual Analysis of Resource Meta-Information. http://www. igd. fhg. De/~neuss.
    [Nguyen et. al., 1996] Nguyen S H, Nguyen H S. Some Efficient Algorithms for Rough Set Methods, Conference of Information Processing and Management of Uncertainty in Knowledge-Based Systems (IPMU'96), Granada, Spain, pp. 1451-1456
    [Nguyen et. al., 1997] Nguyen S H, A. Skowron, P. Synak, J. Wroblewski. Knowledge discovery in databases: Rough set approach. In Proceedings of IFSA'97, Academia, Prague, 204-209
    [Nilsson et. al., 1999] Nilsson, N. J. Artificial Intelligence—A new synthesis.机械工业出版社.
    [Njiwoua et. al., 1997] Njiwoua P, Nguifo E M. Forwarding the choice of bias LEGAL-F: using feature selection to reduce the complexity of LEGAL. Proceedings of BENELEARN-97,ILK and INFOLAB, Tiburg University, The Netherlands, 89-98
    [Nourine et. al., 1999] Nourine L, Raynaud O. A fast algorithm for building lattices. Workshop on computational graph theory and combinatorics, victoria, Canada.
    [Ohrn et. al., 1997] Ohrn A, Komorowski, J. ROSETTA: A Rough Set Toolkit for Analysis of Data, Proc. Third International Joint Conference on Information Sciences, Fifth International Workshop on Rough Sets and Soft Computing (RSSC'97), Durham, NC, USA, Vol. 3, pp. 403-407
    [Ohrn, A., 1999] Ohrn, A. Discerniblity and roughset in medicine: tools and applications. doctoral dissertation, Norwegian university of science and technology, Norway.
    [Oosthuizen G D., 1993] Oosthuizen G D. Rough sets and concept lattices, in W.P.Ziarko ed. Proceedings of RSKD'93, London:Springer-Verlag, 24-31
    [Oosthuizen G D., 1996] Oosthuizen G D. The application of concept lattice to machine learning. technical report, university of pretoria, South Africa
    [Oosthuizen, G.D., 1993] Oosthuizen, G.D. Rough Sets and concept lattices, International workshop on Rough sets and knowledge discovery(RSKD'93), Banff, Alberta, Canada
    [Orlowska et. al., 1998] Orlowska, E. ed. Incomplete information--rough set analsis. Physica-verlag, Heidelberg.
    [Pal, et. al., 1999] Pal, S.K., Skowron, A. Rough Fuzzy Hybridization- A new trend in decision-making, Springer.
    [Pasquier, et. al., 1999] Pasquier, N., Bastide, Y., Taouil, R., Lakhal, L. Efficient mining of association rules using closed itemset lattices. Information systems. Vol.24, No. 1, 25-46
    [Pawlak, Z., 1982] Pawlak, Z. Rough Sets. International Journal of Computer and information
    
    sciences, 11, 341-356.
    [Pawlak, Z., 1991] Pawlak, Z. Rough sets: Theoretical Aspects of Reasoning about Data. Dordrecht: Kluwer Acasemie Publishers
    [Polkowski, et. al., 1998] Polkowski, L. and Skowron A. eds.) Rough sets in knowledge discovery I: Methodology and applications. Physica-verlag, Heidelberg.
    [Polkowski, et. al., 1998] Polkowski, L. and Skowron A. eds. Rough sets in knowledge discovery Ⅱ: Applications, case studies and software systems. Physica-verlag, Heidelberg.
    [Prediger, S., 1997] Prediger, S. Logical scaling in formal concept analysis. D.Lukose et al(eds.) Proceedings of Intl. conf. on conceptual structures(ICCS'97). LNAI 1257, Springer, Berlin, 332-341
    [Sahami M., 1995] Sahami M. Learning classification rules using lattices. In: Lavran N, Wrobel S, eds. Proceedings of ECML-95, Grete, Greece, 343~346
    [Saquer, et. al., 1999] Saquer, J. and Deogun, J.S. Formal rough concept analysis, N.Zhong, A.Skowron and S.Ohsuga (eds.) Proceedings of RSFDGrC'99, Japan, Springer, 1999, 91-99
    [Schmitt et. al., 1998] Schmitt I, Saake G, Merging Inheritance hierarchies for scheme integration based on concept lattices, http://www.mathematic.tu-darmstadt.de/ags/agl
    [Siff M, et. al., 1997] Siff M, Reps T. Identifying modules via concept analysis. International conference on software maintenance. Bari, Italy, Oct, 1997, 170-179
    [Skowron, A. et. al., 1995] Skowron, A. and Nguyen, S H. Quantization of Real Value Attributes: Rough Set and Boolean Reasoning Approach. ICS Research Report 1195, Warsaw University of Technology, Poland
    [Slowinski R, et. al., 1992] Slowinski R, Stefanowski J. 'RoughDAS' and 'RoughClass' Software Implementations of the Rough Sets Approach. In: Slowinski R. Intelligent Decision Support: Handbook of Applica-tions and Advances of Rough Sets Theory. Dordrecht: Kluwer Acasemic Publishers, 445-456
    [Slowinski R, et. al., 2000] Slowinski R, D.Vanderpooten, A generalized definition of rough approximations based on similarity, IEEE Trans. on Data and Knowledge Engineering
    [Starzyk J, et. al., 1999] Starzyk J, Nelson D E, Sturtz K. Reduct generation in information system. Bulletin of international rough set society, 3(1/2): 19-22
    [Swiniarski, R., 1997] Swiniarski, R. Design of nonlinear texture data model using localized principal components and rough sets: Application to texture classification. Proc. of. intl. sin. on Nonlinear theory and its applications, Hawaii, USA.
    [Tsumoto, et. al., 1995] Tsumoto, S., Ziarko, W., Shah, N, Tanaka, H. Knowledge discovery in clinical databases based on variable precision rough sets models. Journal of American
    
    medical informatics association supplement. 270-274.
    [Tsumoto, et. al., 1993] Tsumoto, S. and Tanaka, H. AQ, Rough Sets, and Matroid theory. Proceedings of intl. Wksp. on rough sets and knowledge discovery(RSKD'93), Canada
    [Waiyamai, et. al., 2000] Waiyamai, K. and Lakhal, L. Knowledge discovery from very large databases using frequent concept lattice. ECML-2000, LNAI 1810. 437-445.
    [Wille R., 1982] Wille R. Reconstructing lattice theory: an approach based on hierarchies of concepts, in: Rival I ed. Ordered sets, Reidel
    [Wille, R., 1992] Wille, R. Concept lattices and conceptual knowledge systems. Computers and Math. Applications, Vol.23, no.5-9
    [Yao et. al., 1996] Yao Y Y, T.Y.Lin. Generalization of Rough Sets using modal logics, intelligent Automation and soft computing, 2(2), 103-120
    [Yao Y Y., 1998] Yao Y Y. Constructive and algebraic methods of the theory of rough sets, information sciences, 109:21-47
    [Zaki et. al., 1998] Zaki M J, Ogihara M. Theoretical Foundations of association rules, in Haas L, Tiwary A ed. Proceedings of SIGMOD'98 Workshop on Research Issues in Data Mining and Knowledge Discovery (DMKD), Seattle, WA, 7:1-7:8
    [Ziarko W., 1993] Ziarko W. Variable Precision Rough Set Model. Journal of Computer and System Sciences, 46:39-59
    [洪家荣,1997] 洪家荣.归纳学习--算法,理论,应用.科学出版社
    [陆汝钤,1995] 陆汝钤.人工智能,科学出版社.
    [苗夺谦,1997] 苗夺谦.Rough Set 理论及其在机器学习中的应用研究.中国科学院自动化研究所博士论文.北京.
    [王志海等,1998] 王志海,胡可云,刘宗田等.概念格上粗糙集合运算与函数依赖生成.清华大学学报,38(S2):1-4
    [王志海等,1999] 王志海,胡可云等.概念格上规则提取的一般和渐进式算法.计算机学报,22(1):66-70
    [Denning, 1987] Dorothy E. Denning, An Intrusion-Detection Model. IEEE Transactions on Software Engineering, VOL 13, NO 2,1987,222-232.
    [Fox et al., 1990] Kevin L. Fox, Ronda R. Henning, Jonathan H. Reed, and Richard P. Simonian. A neural network approach towards intrusion detection. Harris Corporation technical Report, 1990.
    [蔡忠闽,2003] 蔡忠闽,管晓宏,邵萍等.基于粗糙集理论的入侵检测方法.计算机学报.2003.26(3):361-366
    [陈奇南,2002] 陈奇南,梁洪峻.模糊集和粗糙集.计算机工程.2002年08期
    [陈湘晖,2001] 陈湘晖,朱善君,吉吟东.基于熵和变精度粗糙集的规则不确定性量度.清华
    
    大学学报(自然科学版).2001年03期
    [陈湘晖,2002] 陈湘晖,朱善君,吉吟东,李永敏.扩展的粗糙集模型及其不确定性量度.清华大学学报(自然科学版).2002年01期
    [郝先臣,2001] 郝先臣,张德干,刘小玲,赵海.基于粗糙集理论的数据挖掘算法及其应用研究.计算机工程与应用.2001年15期
    [胡可云,2000] 胡可云,陆玉昌,石纯一.基于概念格的分类和关联规则的集成挖掘方法.软件学报.2000年11期
    [胡可云,2001] 胡可云.基于概念格和粗糙集的数据挖掘方法研究.清华大学博士论文.2001
    [李永敏,1999] 李永敏,朱善君,陈湘晖,张岱崎,韩曾晋.基于粗糙集理论的数据挖掘模型.清华大学学报(自然科学版).1999年01期
    [梁吉业,2001] 梁吉业,徐宗本,李月香.包含度与粗糙集数据分析中的度量.计算机学报.2001年05期
    [刘宗田,2000] 刘宗田.容差近似空间的广义概念格模型研究.计算机学报.2000年01期
    [苗夺谦,1999] 苗夺谦,王珏.粗糙集理论中概念与运算的信息表示.软件学报.1999年02期
    [石峰,2002] 石峰,娄臻亮,张永清.一种改进的粗糙集属性约简启发式算法.上海交通大学学报.2002年04期
    [王国胤,2001] 王国胤.Rough集理论与知识获取.西安:西安交通大学出版社.2001
    [谢志鹏,2000] 谢志鹏,刘宗田.概念格与关联规则发现.计算机研究与发展2000年12期
    [谢志鹏,2000a] 谢志鹏,刘宗田.基于概念格的关联规则发现.小型微型计算机系统.2000年10期
    [谢志鹏,2000b] 谢志鹏,张卿,刘宗田.基于粗糙集合理论的决策树生成.计算机工程与应用.2000年11期
    [谢志鹏,2001] 谢志鹏,刘宗田.概念格节点的内涵缩减及其计算.计算机工程.2001年03期
    [谢志鹏,2001a] 谢志鹏.基于概念格模型的知识发现研究.合肥工业火学博士论文.2001
    [谢志鹏,2002] 谢志鹏,刘宗田.概念格的快速渐进式构造算法.计算机学报.2002年05期
    [张文修,2000] 张文修,吴伟志.基于随机集的粗糙集模型(Ⅰ).西安交通大学学报.2000年12期
    [张文修,2000a] 张文修,吴伟志.粗糙集理论介绍和研究综述.模糊系统与数学.2000年04期
    [张文修,2001] 张文修,吴伟志等.粗糙集理论.科学出版社.2001年
    [张文宇,2002] 张文宇,薛惠锋,张洪才,彭文祥.粗糙集在数据挖掘分类规则中的应用研究.西北工业大学学报.2002年03期
    [赵文兵,2002] 赵文兵,简宋全,王浩,胡学钢.约简概念格的纵向维护算法.计算机工程与应用.2002年07期

© 2004-2018 中国地质图书馆版权所有 京ICP备05064691号 京公网安备11010802017129号

地址:北京市海淀区学院路29号 邮编:100083

电话:办公室:(+86 10)66554848;文献借阅、咨询服务、科技查新:66554700