臺灣博碩士論文加值系統

現今網路架構越來越複雜，加上網際網路的蓬勃發展及網路活動頻繁，隱藏在網路內的惡意封包對網路安全構成嚴重的威脅，資料探勘是現今非常熱門話題，它可以從記錄檔中尋找出有用的知識並分析正常與異常網路使用上的差異，動態更新防禦機制，類神經網路與決策樹為其中被採用之技術，然而目前並無兩者結合用於封包辨識之研究。本研究旨在結合利用類神經高學習力及決策樹能歸納規則特性運用於辨識封包的攻擊行為，實驗過程並針對各類封包分別比較其誤判率及漏判率，以評估其在各類封包預測之準確度；本實驗三種模型結果顯示 R2L、Probe 誤判率皆大於 90% 以上，漏判率 R2L 也接近 99%，所以本實驗的模型對於 R2L 及 Probe 攻擊封包並沒有很好之辨識效果。

Network architecture is more and more complicated day by day, in addition, the flourishing development of the internet and network activity are frequent, it is a serious threat to network security for the hostile package hidden in the network . Data mining is a hot topic today, it can find out the useful knowledge and differences analyzing between normal and abnormal packages from log, and update defending mechanism dynamically, there are many researches using the neural network and decision tree methodology for internet package analysis, but there is no any research to combine these two methodologies for packages distinguished research. This research combines both the characteristics of neural learns high and decision tree summing up the rules to apply distinguishing behavior of attach of packet. We compare the false positive rate and false negative rate to each kind of package in the experiment to evaluate accurate rate of every kind of attacking package prediction. The result of tree models in our experiment show that false positive rate for R2L and Probe are over 90% ,false negative rate for R2L is over 99%,So the effect is not good for distinguishing R2L and Probe for these models in the research.

第一章 緒論．．．．．．．．．．．．．．．．．．．．．．．．．．．．1
1.1 研究背景動機．．．．．．．．．．．．．．．．．．．．．．．．．．1
1.2 研究目的．．．．．．．．．．．．．．．．．．．．．．．．．．．．1
1.3 論文架構．．．．．．．．．．．．．．．．．．．．．．．．．．．．1
第二章 文獻探討．．．．．．．．．．．．．．．．．．．．．．．．．．2
2.1 攻擊封包．．．．．．．．．．．．．．．．．．．．．．．．．．．．2
2.1.1.封包攻擊的步驟．．．．．．．．．．．．．．．．．．．．．．3
2.1.2.入侵偵測系統 ．．．．．．．．．．．．．．．．．．．．．．4
2.1.3.辨識網路封包相關文獻 ．．．．．．．．．．．．．．．．．．5
2.2 資料探勘．．．．．．．．．．．．．．．．．．．．．．．．．．．．6
2.3 結合決策樹與類神經方面應用文獻 ．．．．．．．．．．．．．．．．9
第三章 研究方法．．．．．．．．．．．．．．．．．．．．．．．．．．11
3.1 研究架構 ．．．．．．．．．．．．．．．．．．．．．．．．．．．11
3.2 前置處理 ．．．．．．．．．．．．．．．．．．．．．．．．．．．13
3.3 建置模型 ．．．．．．．．．．．．．．．．．．．．．．．．．．．19
3.4 評估指標 ．．．．．．．．．．．．．．．．．．．．．．．．．．．21
第四章 實驗結果．．．．．．．．．．．．．．．．．．．．．．．．．．24
4.1 類神經模型 ．．．．．．．．．．．．．．．．．．．．．．．．．．24
4.2 混合決策樹與類神經之模型 ．．．．．．．．．．．．．．．．．．．25
4.3 混合權重、決策樹及類神經之模型 ．．．．．．．．．．．．．．．．26
第五章 結論．．．．．．．．．．．．．．．．．．．．．．．．．．．．28
5.1 整體比較 ．．．．．．．．．．．．．．．．．．．．．．．．．．．28
5.2 辨識個別封包錯誤率比較 ．．．．．．．．．．．．．．．．．．．．28
5.3 各模型結果比較分析 ．．．．．．．．．．．．．．．．．．．．．．29
IX
參考文獻．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．30
附錄A ．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．33
附錄B ．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．34
附錄C ．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．．37

[1] Fang, C.W., “Neural-Based Approaches for Improving the Accuracy of Decision Trees,＂ June 2002.
[2] Hastie, T.,Friedman, J. and Tibshirani, R.,“The element ofstatistical learning,＂ Springer-Verlag, New York, 2001.
[3] Berrym, M. and Linoff, G., “Data Mining Techniques: For Marketing Sale and Customer Support,＂John Wiley & Sons, Inc., 1997.
[4] Bragg, R., Rhodes, O. M. and Strassberg, D., “Newtork Security: the complete reference,＂ McGraw-Hill companies, 2004.
[5] Sherif, J.S. and Dearmond, T.G.,“Intrusion detection: systems and models,＂ Proceedings Eleventh IEEE International Workshops on Enabling Technologies: Infrastructure for CollaborativeEnterprises, Vol.10, pp.115-133, June 2002.
[6] Chan, A.P.F., Ng, W.W.Y., Yeung, D.S. and Tsang, C.C., “Refinement of rule-based intrusion detection system for denial of service attacks by support vector machine,＂ Machine Learning and Cybernetics, Vol.7, pp.4252-4256, 2004.
[7] Seleznyov, A. and Puuronen, S., “HIDSUR: a hybrid intrusion detection system based on real-time user recognition,＂ Database and Expert Systems Applications, Vol.4, No.8, pp.41-45, September 2000.
[8] Kim, S. and Kim, Y., “A fast multiple string pattern matching algorithm,＂ In Proceedings of 17th AoM/IAoM Conference on Computer Science, August 1999.
[9] Yan, Q. and Xie, W., “A Network IDS with low false positive rate,＂ Evolutionary Computation, CEC ''02. Proceedings of the 2002 Congress on Vol. 2, pp. 1121–1126, May 2002.
[10] Pan, Z.S., Lian, H., Hu, G.Y.and Ni, G.Q., “An integrated model of intrusion detection based on neural network and expert system,＂ICTAI 05. 17th IEEE International Conference on pp. 2, November 2005.
[11] Anderson, J.P., “Computer Security Threat Monitor and Survcllance,＂ James P.Anderson CO,Fort Washington,April 1980.
[12] Pan, Z.S., Chen,S.C., Hu, G.B. and Zhang, D.Q., “ Hybrid neural network and C4.5 for misuse detection,＂ Machine Learning and Cybernetics, 2003 International Conference on Vol. 4, November 2003.
31
[13] Li, A.J., Liu, Y.H.and Luo, S.W., “On the solution of the XOR problem using the decision tree-based neural network,＂ Machine Learning and Cybernetics, 2003 International Conference on Volume 2, November 2003.
[14] Tung, K. Y.,Huang,I.C.,Chen,S.L. and Shih,C.T. “Mining the Generation Xers'' job attitudes by artificial neural network and decision tree-empirical evidence in Taiwan,＂ Expert Systems with Applications, Vol. 29, No. 4,pp.783-94, November 2005.
[15] KDD Cup 1999 Data, http://kdd.ics.uci.edu/databases/kddcup99/
kddcup99.html , 28 October 1999.
[16] IBM Web site http://www.ibm.com.
[17] 馬莉芋，資料探勘在網路入侵偵測上之研究，私立銘傳大學，碩士論文，2004.
[18] 吳志聰，以特徵探勘提升入侵偵測系統效率，私立中原大學，碩士論文，2003.
[19] 郭一聰，應用決策樹與類神經網路於應收帳款之呆帳預警模式研究，私立中原大學，碩士論文，2005.
[20] 黃國華，應用類神經網路與決策樹於鉛酸蓄電池容量之估測,國立台北科技大學，碩士論文，2004.
[21] 楊宗彥，運用類神經網路與決策樹技術預測股票報酬率，私立逢甲大學，碩士論文，2003.
[22] 彭文正譯，Berry and Linoff 著，資料採礦：顧客關係管理暨電子行銷之應用，維科出版社，2002.
[23] 樓玉玲，以資料發掘技術分析政大通識課程，國立政治大學，碩士論文，1997.
[24] 曾新穆、李建億譯，資料探勘，東華書局，2003.
[25] 文少宣 ，類神經網路與決策樹在顧客關係管理應用之比較，私立中華大學，碩士論文，2005.
[26] 詹純源，以無向性貝氏網路為基礎之網頁入侵偵測系統，國立雲林科技大學，碩士論文，2002.
[27] 張民杰，運用於提升入侵偵測效能的快速多重字串比對，國立臺灣大學，碩士論文，2003.
[28] 李鎮原，應用類神經網路於異常入侵偵測之比較研究，國立國防管理學院，碩士論文，2004.
[29] 林惠君，改善以規則為基礎的入侵偵測系統封包比對效能之研究，國立交通大學，碩士論文，2003.
[30] 陳忠鴻，應用於入侵偵測之創新樣式搜尋演算法，國立成功大學，碩士論文，2003.
32
[31] 張繼方，模糊專家系統於網路入侵偵測之研究，私立中國文化大學，碩士論文，2003.
[32] 林泰維，利用環境因素考量入侵偵測系統分析工具的選取方法，私立中原大學，碩士論文，2000.
[33] 李駿偉、田筱榮、黃世昆，入侵偵測分析方法評估與比較 “Communications of the CCISA ＂ Vol. 8, No.2 March 2002.
[34] 陳彥銘、張嘉文，以人工免疫學建構高穩定度入侵偵測演算法，國立高雄第一科技大學，碩士論文，2006.