混合類神經與決策樹辨識封包之攻擊行為

Maxing Technologies of Neural and Decision Tree Distinguish Behavior of Attach of Packet

陳文賢(Chen Wen Hsien)

指導教授 ： 劉俞志

元智大學/資訊學院/資訊管理學系/碩士(2007年)

摘要

現今網路架構越來越複雜，加上網際網路的蓬勃發展及網路活動頻繁，隱藏在網路內的惡意封包對網路安全構成嚴重的威脅，資料探勘是現今非常熱門話題，它可以從記錄檔中尋找出有用的知識並分析正常與異常網路使用上的差異，動態更新防禦機制，類神經網路與決策樹為其中被採用之技術，然而目前並無兩者結合用於封包辨識之研究。本研究旨在結合利用類神經高學習力及決策樹能歸納規則特性運用於辨識封包的攻擊行為，實驗過程並針對各類封包分別比較其誤判率及漏判率，以評估其在各類封包預測之準確度；本實驗三種模型結果顯示 R2L、Probe 誤判率皆大於 90% 以上，漏判率 R2L 也接近 99%，所以本實驗的模型對於 R2L 及 Probe 攻擊封包並沒有很好之辨識效果。

關鍵字

決策樹 ； 類神經網路倒傳遞類神經網路資料探勘

並列摘要

Network architecture is more and more complicated day by day, in addition, the flourishing development of the internet and network activity are frequent, it is a serious threat to network security for the hostile package hidden in the network . Data mining is a hot topic today, it can find out the useful knowledge and differences analyzing between normal and abnormal packages from log, and update defending mechanism dynamically, there are many researches using the neural network and decision tree methodology for internet package analysis, but there is no any research to combine these two methodologies for packages distinguished research. This research combines both the characteristics of neural learns high and decision tree summing up the rules to apply distinguishing behavior of attach of packet. We compare the false positive rate and false negative rate to each kind of package in the experiment to evaluate accurate rate of every kind of attacking package prediction. The result of tree models in our experiment show that false positive rate for R2L and Probe are over 90% ,false negative rate for R2L is over 99%,So the effect is not good for distinguishing R2L and Probe for these models in the research.

並列關鍵字

decision tree ； neural network ； back-propagation neural network ； data mining

參考文獻

[1] Fang, C.W., “Neural-Based Approaches for Improving the Accuracy of Decision Trees,＂ June 2002.

[5] Sherif, J.S. and Dearmond, T.G.,“Intrusion detection: systems and models,＂ Proceedings Eleventh IEEE International Workshops on Enabling Technologies: Infrastructure for CollaborativeEnterprises, Vol.10, pp.115-133, June 2002.

[6] Chan, A.P.F., Ng, W.W.Y., Yeung, D.S. and Tsang, C.C., “Refinement of rule-based intrusion detection system for denial of service attacks by support vector machine,＂ Machine Learning and Cybernetics, Vol.7, pp.4252-4256, 2004.

[7] Seleznyov, A. and Puuronen, S., “HIDSUR: a hybrid intrusion detection system based on real-time user recognition,＂ Database and Expert Systems Applications, Vol.4, No.8, pp.41-45, September 2000.

[10] Pan, Z.S., Lian, H., Hu, G.Y.and Ni, G.Q., “An integrated model of intrusion detection based on neural network and expert system,＂ICTAI 05. 17th IEEE International Conference on pp. 2, November 2005.