SSIDS：扩展数据逻辑分析的半监督入侵检测系统
SSIDS: Semi-Supervised Intrusion Detection System by Extending the Logical Analysis of Data
摘要：
传统的入侵检测系统（IDS）由于网络流量的巨大和攻击者使用的欺骗性网络使用模式而不再有效，因此防止对关键网络资源的网络攻击已经成为一个重要的问题。缺乏足够数量的标记观测用于训练IDS使得半监督IDS成为首选。我们提出了一个半监督入侵检测系统扩展的数据分析技术称为逻辑分析数据，或LAD在短期内，这是作为一个监督学习的方法。LAD使用部分定义的布尔函数（pdBf）和它们的扩展来从过去的观测中找到正模式和负模式，以用于对未来的观测进行分类。我们扩展了LAD，使其成为半监督的设计一个IDS。拟议的小岛屿发展中国家战略包括两个阶段：离线和在线。离线阶段通过识别正常和异常网络使用的行为模式来构建分类器。然后，将这些模式转换为分类规则，并在在线阶段使用这些规则来检测异常网络行为。实验结果表明，所提出的SSIDS的性能远远优于现有的半监督IDS，并与监督IDS相当。
英文摘要：
Prevention of cyber attacks on the critical network resources has become an important issue as the traditional Intrusion Detection Systems (IDSs) are no longer effective due to the high volume of network traffic and the deceptive patterns of network usage employed by the attackers. Lack of sufficient amount of labeled observations for the training of IDSs makes the semi-supervised IDSs a preferred choice. We propose a semi-supervised IDS by extending a data analysis technique known as Logical Analysis of Data, or LAD in short, which was proposed as a supervised learning approach. LAD uses partially defined Boolean functions (pdBf) and their extensions to find the positive and the negative patterns from the past observations for classification of future observations. We extend the LAD to make it semi-supervised to design an IDS. The proposed SSIDS consists of two phases: offline and online. The offline phase builds the classifier by identifying the behavior patterns of normal and abnormal network usage. Later, these patterns are transformed into rules for classification and the rules are used during the online phase for the detection of abnormal network behaviors. The performance of the proposed SSIDS is far better than the existing semi-supervised IDSs and comparable with the supervised IDSs as evident from the experimental results.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
