基于邻域量化容差条件熵增量式更新的网络入侵检测方法
作者:
作者单位:

南京邮电大学管理学院,南京210003

作者简介:

通讯作者:

基金项目:

国家自然科学基金(72171124);江苏高校哲学社会科学研究重大项目(2021SJZDA129);江苏省研究生科研创新计划项目(KYCX21_0838)。


Network Intrusion Detection Method Based on Incremental Updating of Neighborhood Valued Tolerance Condition Entropy
Author:
Affiliation:

School of Management, Nanjing University of Posts and Telecommunications, Nanjing 210003, China

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
    摘要:

    网络入侵检测系统是网络信息安全防护的重要防御工具,而复杂的、冗长的网络入侵行为特征严重影响了网络入侵检测的效果。针对网络入侵检测中信息量增长迅速、数据不完备的现实问题,提出一种基于邻域量化容差条件熵增量式更新的特征选择算法。首先,在邻域量化容差粒计算的基础上,结合条件熵在刻画特征不确定性、对特征之间的相关或依赖程度方面的显著特性,研究了邻域量化容差条件熵的增量式更新机制;然后,基于该更新机制提出动态数据库增量式更新的特征选择算法;最后,通过数据实验分析验证了所提出的算法能有效提高不完备信息系统特征选择的计算效率。新提出的算法在网络入侵检测实例应用中体现的计算复杂度及虚警率低的优势,表明其可为网络信息安全防护提供有效可行的具体方法。

    Abstract:

    Network intrusion detection system is an important defense tool for network information security protection, and the complicated and lengthy network intrusion behavior features seriously affect the effectiveness of network intrusion detection. In order to solve the problem of rapid information growth and incomplete data in network intrusion detection, an incremental feature selection algorithm based on neighborhood valued tolerance condition entropy is proposed. Firstly, on the basis of neighborhood valued tolerance granular computing, combined with the remarkable characteristics of conditional entropy in characterizing the uncertainty of features and the correlation or dependency between features, the incremental updating mechanism of neighborhood valued tolerance conditional entropy is studied. Then, based on the update mechanism, an incremental feature selection algorithm for dynamic database is proposed. Finally, the experimental analysis shows that the proposed algorithm can effectively improve the computational efficiency of feature selection in incomplete information systems. The new algorithm has the advantages of low computational complexity and low false alarm rate in the application of network intrusion detection examples, which shows that it can provide effective and feasible concrete methods for network information security protection.

    参考文献
    相似文献
    引证文献
引用本文

骆公志,侯若娴.基于邻域量化容差条件熵增量式更新的网络入侵检测方法[J].数据采集与处理,2024,(1):181-192

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
历史
  • 收稿日期:2022-11-07
  • 最后修改日期:2023-06-08
  • 录用日期:
  • 在线发布日期: 2024-01-25