CAJ | 학술논문

入侵检测（ID ）是保障网络安全的必要手段之一，将数据挖掘引入入侵检测中使其可以适应海量审计数据的处理，同时可以提高检测的均衡性和响应时间。文章提出了一种基于随机森林（random forest ，RF）的入侵检测模型（1R‐RF），针对RF模型面对高维网络审计数据选择属性时过度随机导致的元分类器效率不高的问题，开展了基于One‐R快速属性评价的研究。实验证明，将基于One‐R的RF用于入侵检测后有较好的时空性能、较低的误报率和漏报率，对于各种攻击行为有着较为均衡的检测率。
입침검측（ID ）시보장망락안전적필요수단지일，장수거알굴인입입침검측중사기가이괄응해량심계수거적처리，동시가이제고검측적균형성화향응시간。문장제출료일충기우수궤삼림（random forest ，RF）적입침검측모형（1R‐RF），침대RF모형면대고유망락심계수거선택속성시과도수궤도치적원분류기효솔불고적문제，개전료기우One‐R쾌속속성평개적연구。실험증명，장기우One‐R적RF용우입침검측후유교호적시공성능、교저적오보솔화루보솔，대우각충공격행위유착교위균형적검측솔。
The intrusion detection(ID) is one of the critical techniques to protect the security of net‐work .The intrusion detection model becomes more proper to process large amount of audit data and achieves balanced detecting performance and low corresponding time by data mining technique intro‐duced .In this paper ,a novel intrusion detection model based on the random forest (1R‐RF ) is pro‐posed .Aiming at improving the base tree’s performance of RF w hen over‐randomly selecting features from high dimensional audit data ,the algorithm for feature selection based on One‐R(1R) is studied . The experimental results show that the 1R‐RF intrusion detection model has good space‐time perform‐ance and has lower rates of false and loss alarms .Additionally ,this model has balanced detecting per‐formance with regard to various intrusion attacks .