混合類神經與決策樹辨識封包之攻擊行為

Maxing Technologies of Neural and Decision Tree Distinguish Behavior of Attach of Packet

陳文賢(Chen Wen Hsien)

指導教授 ： 劉俞志

元智大學/資訊學院/資訊管理學系/碩士(2007年)

摘要

現今網路架構越來越複雜，加上網際網路的蓬勃發展及網路活動頻繁，隱藏在網路內的惡意封包對網路安全構成嚴重的威脅，資料探勘是現今非常熱門話題，它可以從記錄檔中尋找出有用的知識並分析正常與異常網路使用上的差異，動態更新防禦機制，類神經網路與決策樹為其中被採用之技術，然而目前並無兩者結合用於封包辨識之研究。本研究旨在結合利用類神經高學習力及決策樹能歸納規則特性運用於辨識封包的攻擊行為，實驗過程並針對各類封包分別比較其誤判率及漏判率，以評估其在各類封包預測之準確度；本實驗三種模型結果顯示 R2L、Probe 誤判率皆大於 90% 以上，漏判率 R2L 也接近 99%，所以本實驗的模型對於 R2L 及 Probe 攻擊封包並沒有很好之辨識效果。

關鍵字

決策樹 ； 類神經網路倒傳遞類神經網路資料探勘

並列摘要

Network architecture is more and more complicated day by day, in addition, the flourishing development of the internet and network activity are frequent, it is a serious threat to network security for the hostile package hidden in the network . Data mining is a hot topic today, it can find out the useful knowledge and differences analyzing between normal and abnormal packages from log, and update defending mechanism dynamically, there are many researches using the neural network and decision tree methodology for internet package analysis, but there is no any research to combine these two methodologies for packages distinguished research. This research combines both the characteristics of neural learns high and decision tree summing up the rules to apply distinguishing behavior of attach of packet. We compare the false positive rate and false negative rate to each kind of package in the experiment to evaluate accurate rate of every kind of attacking package prediction. The result of tree models in our experiment show that false positive rate for R2L and Probe are over 90% ,false negative rate for R2L is over 99%,So the effect is not good for distinguishing R2L and Probe for these models in the research.

並列關鍵字

decision tree ； neural network ； back-propagation neural network ； data mining

參考文獻

[30] 陳忠鴻，應用於入侵偵測之創新樣式搜尋演算法，國立成功大學，碩士論文，2003.

[19] 郭一聰，應用決策樹與類神經網路於應收帳款之呆帳預警模式研究，私立中原大學，碩士論文，2005.

[18] 吳志聰，以特徵探勘提升入侵偵測系統效率，私立中原大學，碩士論文，2003.

[27] 張民杰，運用於提升入侵偵測效能的快速多重字串比對，國立臺灣大學，碩士論文，2003.

[1] Fang, C.W., “Neural-Based Approaches for Improving the Accuracy of Decision Trees,＂ June 2002.