可用於雲端環境下之具適應性入侵偵測系統

Abstract

隨著來自網路的攻擊不斷增加，入侵偵測系統經常被設置於網路中的最前端做偵測攻擊之用。為了達到異常偵測的功能，機器學習或資料探勘的演算法經常被用來實作這類的入侵偵測系統。然而，這些演算法通常需要一個龐大且已標記的資料集來做為訓練及學習的對象，而這樣的資料集在現實中是十分難以取得的。在本論文中，我們提出一個具有適應性的入侵偵測系統，此系統使用「譜聚類」這個非監督式學習演算法來標記來自網路上的連線資料，並根據這些資料使用決策樹來建構此系統的偵測器。此外，此系統的架構使其可以很容易的佈署到雲端環境中。實驗結果顯示，此系統經過對新標記的資料集進行適應的過程後，在偵測攻擊的表現上有顯著的進步。

With the advances and extensive deployment of the computer network, attacks from the Internet increase significantly. In order to detect those intrusions for further defending actions, the network-based intrusion detection system is usually used as the frontline detector. Since the means of attacks change rapidly, the intrusion detection system usually adopts machine learning or data mining algorithms to achieve anomaly detection. However, this kind of algorithms needs a set of labeled data for training the detection model, but this kind of data set is hard to obtain. In this thesis, we proposed a system that is adaptive for the ever-changing network environment. The system can construct a decision tree-based detection model for intrusion detection from unlabeled data by using an unsupervised learning algorithm called spectral clustering. And the system can be easily deployed on the Cloud environment. In the experiments with the DARPA 2000 data set and the KDD Cup 1999 data set, our system shows notable improvement on the detection performance after the adaptation procedure.