论文标题
SSID：通过扩展数据的逻辑分析，半监督入侵检测系统
SSIDS: Semi-Supervised Intrusion Detection System by Extending the Logical Analysis of Data
论文作者
论文摘要
预防关键网络资源的网络攻击已成为一个重要问题，因为由于网络流量的大量和攻击者使用的网络使用模式，传统的入侵检测系统（IDS）不再有效。缺乏足够数量的标记观测值来训练IDSS，使半监督IDSS成为首选。我们通过扩展一种称为数据逻辑分析的数据分析技术或简称LAD，提出了一个半监督的ID，该技术是作为监督学习方法提出的。 LAD使用部分定义的布尔函数（PDBF）及其扩展来找到过去观察结果的正面和负面模式，以分类未来的观察结果。我们扩展小伙子，使其半监督以设计ID。拟议的SSID包括两个阶段：离线和在线。离线阶段通过识别正常和异常网络使用的行为模式来构建分类器。稍后，这些模式将转换为分类规则，并在在线阶段使用规则来检测异常网络行为。所提出的SSID的性能远胜于现有的半监督IDS，并且与监督的IDS相媲美，从实验结果中可以明显看出。
Prevention of cyber attacks on the critical network resources has become an important issue as the traditional Intrusion Detection Systems (IDSs) are no longer effective due to the high volume of network traffic and the deceptive patterns of network usage employed by the attackers. Lack of sufficient amount of labeled observations for the training of IDSs makes the semi-supervised IDSs a preferred choice. We propose a semi-supervised IDS by extending a data analysis technique known as Logical Analysis of Data, or LAD in short, which was proposed as a supervised learning approach. LAD uses partially defined Boolean functions (pdBf) and their extensions to find the positive and the negative patterns from the past observations for classification of future observations. We extend the LAD to make it semi-supervised to design an IDS. The proposed SSIDS consists of two phases: offline and online. The offline phase builds the classifier by identifying the behavior patterns of normal and abnormal network usage. Later, these patterns are transformed into rules for classification and the rules are used during the online phase for the detection of abnormal network behaviors. The performance of the proposed SSIDS is far better than the existing semi-supervised IDSs and comparable with the supervised IDSs as evident from the experimental results.
