以資料探勘技術分析網路異常行為

隨著網路技術和應用不斷地蓬勃發展，網路攻擊入侵的手法也日新月異，因而在資訊系統的安全以及有效的入侵偵測系統是重要的課題。傳統的入侵偵測系統（IDS），採誤用入侵偵測技術為依據，具高準確率與低誤判率，但缺點需不斷更新特徵碼，且對於未知攻擊無抵抗之能力。本研究利用資料探勘技術嘗試解決此問題，透過機器學習之隨機森林分類器，把網路封包資料集建立模型，透過模型預測異常的網路攻擊。本研究實驗樣本採樣於實際網路流量（FortiGate_Traffic_Log）作為實驗的數據集，單筆資料有68個屬性，將原始資料集完成前處理後，將90％作為訓練資料集，採Weka軟體內隨機森林分類器訓練模型的建立，再以10％的測試資料集驗證其模型識別的準確性。在本研究的實作中，我們建立的訓練模型，可以在真實網路環境中，判斷的準確率可達95％以上有效偵測異常網路流量。關鍵字：網路入侵偵測、異常偵測、隨機森林

關鍵字

網路入侵偵測；異常偵測；隨機森林

並列摘要

With the internet technology and applications continuously and rapidly advancing, the methods of internet hacking and attacks are also constantly evolving and changing. Therefore, the security of information systems and effective intrusion detection systems have become important issues. Most of traditional Intrusion Detection System (IDS) utilize the misused detection technology which have high accuracy and low false judgment rate as basis, but the disadvantage of IDS is the signature database needs to be updated constantly so it can cope with a variety of malware attacks and it is not capable of detecting and blocking anonymous cyber attacks. In this thesis, we attempt to overcome above issues by using data exploration technology, data-mining, machine learning and Random Forest algorithm to build a training model and we use this model as the core classification tool for anomaly network traffic detection system to recognize and detect attacks. These experiments were performed on the real network environment. We collect traffic logs from firewall network as data sets. In our experiments, this proposed method can achieve much higher accuracy than other methods. The training model we built can detect abnormal traffic in the real network environment with an accuracy of more than 95%. Keywords：Intrusion Detection System (IDS), Anomaly Network Traffic Detection, Date Mining, Random Forest.