Snort improvement method based on data mining algorithm

Abstract

The invention relates to a Snort improvement method based on a data mining algorithm. The method comprises the following steps that: acquiring, by an intrusion detection Snort system, data P on a network; carrying out similarity clustering on the P and a normal behavior database by utilizing an improved K-means algorithm, if the similarity is smaller than a clustering radius r, judging the P and the normal behavior database as normal data, and directly skipping a misuse detection process of Snort; otherwise, comparing the data with the abnormal database in the Snort again, calculating the similarity between the data and each abnormal behavior class, if the data can be clustered in the abnormal behavior classes, indicating that the data is of an abnormal data type, and sending out a corresponding alarm by the system; and if the abnormal class still cannot be clustered, adding the abnormal class to the normal database, and updating the normal behavior database again. Most of the data onthe network is normal data, the abnormal data only occupies a small part, the clustering accuracy of the improved K-means algorithm is high, and the data processed by misuse of a detection engine canbe greatly reduced through the above mode, so that the overall detection accuracy and efficiency of the Snort system are improved.

Description

technical field [0001] The invention belongs to the technical field of information security, and relates to a method for improving Snort based on a data mining algorithm. Background technique [0002] With the rapid development of the network, the "Internet +" model has been widely used. At the same time, network intrusion technology is also developing, the security situation of the Internet and information communication networks is more severe, and the impact of deliberate attacks and sabotage is more extensive. In the face of complex and diverse attack methods, the traditional database security mechanism is somewhat weak. Intrusion detection is a new generation of security defense technology. IDS Snort is a network intrusion detection system (Network IntrusionDetection System.NIDS), which has a very important position in the industry, especially in the domestic security industry. It is regarded as the industry standard; Snort is an easy-to-extend open source NIDS, which ...

AI Technical Summary

Problems solved by technology

However, the Kmeans algorithm has been criticized by people for its inaccurate clustering results due to the randomness of its initial clustering center k.

Images