An Optimized Method Of Decision Tree And Its Application In Intrusion Detection

The security of information is becoming more and more critical. However, network is vulnerable by outside attacks and destruction because of its openness. Thus it is a big challenge to maintain the secrecy and security of information. Intrusion Detection is a very important field in maintaining computer and network security and its technique is an important supplement to other techniques of information security.The core problem of Intrusion Detection is classification, i.e, a question of classifying a case to normal or anomaly pool. The techniques of classification include rough sets, neural network, statistics, naive bayes, support vector machine (SVM) and decision tree, etc. Compared to other techniques, decision tree has many advantages: non-parametric, fast construction and high degree of interpretability. Of course, the techniques of decision tree have some defects as well. Such as, local optimality, taking no account of the relation among attributions on the case of testing and selecting of split-off property and overlooking the balancing between the precision of forecast and the size of rules.In this dissertation, the algorithms of ID3, C4.5 for the construction of decision tree is discussed, and an optimal method for the construction of decision tree by applying genetic algorithms is proposed based on the balancing between the precision of predict and the size of rules. The experiments demonstrate that the method can notably cut down the size of rules without over sacrificing the classifying precision. Therefore, it is more practical.At the end of the dissertation, a MIDS(Misuse Intrusion Detection System) is devised and implemented. This system implements the following functions: Decision Tree optimization, testing and evaluating the decision tree optimized as above, and building the Classifier of Intrusion Detection according to the results tested and evaluated.