论文标题
机器学习应用中的滥用和异常检测应用
Machine Learning Applications in Misuse and Anomaly Detection
论文作者
论文摘要
机器学习和数据挖掘算法在设计入侵检测系统中起着重要作用。基于他们检测网络攻击的方法，可以将入侵检测系统大致分为两种类型。在滥用检测系统中，每当网络中的活动序列与已知攻击签名匹配时，都会检测到系统中的攻击。另一方面，在系统中的异常检测方法中，系统中的异常状态是根据系统与正常状态的状态过渡的显着差异确定的。本章对基于滥用检测，异常检测和混合检测方法的一些现有入侵检测方案进行了全面讨论。还确定了一些未来研究的研究方向。
Machine learning and data mining algorithms play important roles in designing intrusion detection systems. Based on their approaches toward the detection of attacks in a network, intrusion detection systems can be broadly categorized into two types. In the misuse detection systems, an attack in a system is detected whenever the sequence of activities in the network matches with a known attack signature. In the anomaly detection approach, on the other hand, anomalous states in a system are identified based on a significant difference in the state transitions of the system from its normal states. This chapter presents a comprehensive discussion on some of the existing schemes of intrusion detection based on misuse detection, anomaly detection and hybrid detection approaches. Some future directions of research in the design of algorithms for intrusion detection are also identified.
