Research Of Intrusion Detection Method Based On Rough Sets

Intrusion detection is for the detection of intrusions and attacks by collecting and analyzing network behaviors, security logs, audit dataset and other Internet information and some key points in a computer system of information, to inspect the network or system for the presence of the security violating strategy behavior and the signs of an attack. Intrusion detection system, as a kind of positive safe protection technology which provides real-time protection for internal and external attack and attack of the incorrect operation of, response before the invasion in the network system harm intercept. Therefore it is considered for the second security gate following with the firewall. It greatly improves the network system security without affecting the performance of network situations by monitoring network.Rough set theory is a new mathematical tool for handling the vague and uncertainty proposed by the Poland scholar Z.Pawlak in 1982. It is regarded as extremely vital significance for the artificial intelligence and the cognitive science, which provides a theoretical framework for the machine learning, data mining, knowledge acquisition, pattern recognition and approximate reasoning and other areas of information processing. Based on this, it makes a certain theoretical feasibility for the rough sets applied in intrusion detection field.This paper is mainly about Rough set theory into the concrete field of intrusion detection, which based on the intrusion detection technology of Rough set. In guarantee of intrusion detection function unchanged, to deal with the object data with the attribute reduction algorithm of Rough set. It has greatly reduced the characteristics of the dimension, the information redundancy and improved the intrusion detection data extraction and intrusion detection rates by removing redundant data. It has showed that the rough set theory applied in intrusion detection method is effective, and achieved good inspection of rate and low by mistake examining rate through KDDCup99 data set in the experimental results.