The Reduction Method And Its Application Of Covering Decision System

Intrusion detection system can provide real-time protection for computer network from external attack,internal attack and misoperation automatically,which is an important network security tool now.Attribute reduction based on rough sets is a popular tool in intrusion detection systems to remove redundant and interfering data,and thus improve detection efficiency and detection rate.But the existing attribute reduction methods for intrusion detection system are of high time and space complexities,which is useless in rapid reduction for large-scale intrusion detection data,and most of them are static,whose computation efficiency is very low for dynamic intrusion detection data.As a result,the intrusion detection speed is far less than the network transmission speed,which makes IDS difficult to raise an alarm in time and prevent the intrusion,thus causing serious losses.Therefore,it is important to improve attribute reduction efficiency so as to speed up the intrusion detection and lower invasion losses.On the basis of the fuzzy covering attribute reduction algorithm based on consistent matrix(RCM)proposed by our research team,two different attribute reduction methods,static and dynamic,are adopted to solve the problem of the difficulty in processing large-scale data and dynamic data in the current intrusion detection system.Firstly,for large-scale intrusion detection data,the RCM is applied to the intrusion detection system,so as to quickly delete the redundant and interfering data in the intrusion decision table,and thus not only improve the efficiency and detection rate of the intrusion detection system,but also lower the false alarm rate and missing alarm rate.Secondly,on the basis of RCM method,four different fuzzy covering dynamic attribute reduction algorithms based on consistent matrix(DRCM)are designed for dynamic intrusion detection data,so as to further improve the attribute reduction efficiency and meet the requirement of real-time attribute reduction calculation for dynamic intrusion decision table.Finally,the above two kinds of attribute reduction methods are used for the reduction of NSL-KDD to quickly extract key attributes and delete redundant data.The experimental results show that,compared with attribute reduction based on neighborhood rough set model,heuristic algorithm based on neighborhood discrimination index,heuristic algorithm based on fitting fuzzy rough sets,RCM can quickly compute the attribute reduction of the intrusion decision table while maintaining the intrusion classification information,and thus improve the intrusion detection efficiency and detection rate.Besides,once the attributes or objects in the intrusion decision table change,DRCM dynamic attribute reduction algorithms can avoid a large number of repeated calculations in RCM while obtaining the same reduction results with RCM,further improve dynamic intrusion detection efficiency.