基于D_S证据理论网络异常检测方法_诸葛建伟.pdfVIP

ISSN 1000-9825, CODEN RUXUEW E-mail: jos@ Journal of Software , Vol.17, No.3, March 2006, pp.463−471 DOI: 10.1360/jos170463 Tel/Fax: +86-10 © 2006 by Journal of Software. All rights reserved. ∗ 基于 D-S 证据理论的网络异常检测方法 + , , , , 诸葛建伟 王大为 陈 昱 叶志远 邹 维 (北京大学 计算机科学技术研究所,北京 100871) A Network Anomaly Detector Based on the D-S Evidence Theory + ZHUGE Jian-Wei , WANG Da-Wei, CHEN Yu, YE Zhi-Yuan, ZOU Wei (Institute of Computer Science and Technology, Peking University, Beijing 100871, China) + Corresponding author: Phn: +86-10 E-mail: zhugejianwei@, ZhuGe JW, Wang DW, Chen Y, Ye ZY, Zou W. A network anomaly detector based on the D-S evidence theory. Journal of Software, 2006,17(3):463−471. /1000-9825/17/463.htm Abstract : Network anomaly detection has been an active research topic in the field of Intrusion Detection for many years, however, it hasn’t been widely applied in practice due to some issues. The issues include high false alarm rate, limited types of attacks the approach can detect, and that such approach can’t perform real-time intrusion detection in high speed networks. This paper presents a network anomaly detector based on Dempster-Shafer (D-S) evidence theory. The detector fuses multiple features of network traffic to decide whether the network flow is normal, and by such fusion it achieves low false alarm rate and missing rate. It also incorporates some self-adaptation mechanisms to yield high accuracy of detection in dynamic networks. Furthermore, light-computation features are