Research Of An Intrusion Detection Model Based On Statistics
Hu Yuanjia · Microcomputer Information · 2007
The traditional information protection technique based on information encryption is passive. This can’t satisfy the need of the modern information security, so the defense technique of the active detection on attack becomes urgently important. This text then puts forward an intrusion detection model based on statistics according to this kind of need. Audit records are the foundation of the intrusion detection model. This text uses the neural network technique to train these audit records, and then gets the normal zone of each attribute. It will get value vector by computing the zone selection algorithm. Then we can compute the weighted intrusion score and the suspicion quotient by putting the weighted vector and the Bernoulli vector together. The suspicion quotient is a basis to judge whether an intrusion has happened or not. The bigger the value of the suspicion quotient is, the more possibility of an intrusion. Ac- cording to the experiences of the experts in this field, the model will alarm automatically if we configure the corresponding values.