CFAR检测器提升网络入侵检测性能：融合与优化策略

147 浏览量更新于2024-08-28 收藏 822KB PDF 举报

本文主要探讨了在网络安全领域中利用CFAR（Constant False Alarm Rate）突变检测器进行入侵检测的方法。CFAR算法是一种广泛应用于目标检测和异常检测中的技术，其原理是通过设定一个恒定的虚警率来自动调整检测阈值，以提高检测性能。作者首先提出了一种将自回归系统应用于网络流量模型的策略，通过该模型预测网络流量，并指出预测误差可以近似服从高斯分布。在此基础上，文章重点介绍了三种不同的CFAR检测方法： 1. **最优CFAR**：这是一种基于最优化理论的CFAR，旨在最大化检测效率的同时保持恒定的虚警率。最优CFAR能够更精确地捕捉到潜在的异常模式，从而提高入侵检测的准确度。 2. **细胞平均CFAR**：这种技术通过对检测窗口内的多个样本取平均值，降低了随机噪声的影响，增强了对异常变化的敏感性。它能够在处理复杂网络流量时提供稳定且可靠的检测结果。 3. **序统计CFAR**：这种方法利用统计学的序统计特性，通过分析流量序列的顺序特征来识别潜在的攻击行为。序统计CFAR在面对多种类型的数据模式时展现出良好的适应性。此外，作者还提出了融合上述CFAR检测器的策略，利用 Dempster-Shafer 和 Bayesian 技术进行集成，以进一步提升整体的入侵检测性能。通过使用DARPA（Defense Advanced Research Projects Agency）提供的交通数据进行计算机模拟实验，结果显示，与传统检测方法相比，基于CFAR的入侵检测方法能显著提高检测概率，且在面对不同类型的网络攻击时，表现出一致的性能提升。这篇研究论文深入剖析了如何利用CFAR突变检测器改进网络入侵检测系统，通过精确的预测模型、多种CFAR策略以及集成学习技术，显著提升了网络安全防御的效能。这为未来的网络安全实践提供了有价值的理论支持和技术参考。

490 IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT, VOL. 57, NO. 3, MARCH 2008

Network Intrusion Detection Using CFAR

Abrupt-Change Detectors

Di He, Member, IEEE, and Henry Leung, Member, IEEE

Abstract—In this paper, the constant false alarm rate (CFAR)

detectors are proposed for network intrusion detection. By using

an autoregressive system to model the network trafﬁc, predictor

error is shown to closely follow a Gaussian distribution. CFAR

detector approaches are then developed on the prediction error

distribution. In the present study, we consider the optimal CFAR,

the cell-averaging CFAR, and the order statistics CFAR. The use

of these CFAR techniques can signiﬁcantly improve the detection

performance. In addition, we propose the use of fusion of these

CFAR detectors by using Dempster–Shafer and Bayesian tech-

niques. Computer simulations based on the DARPA trafﬁc data

show that the proposed approach achieves higher detection prob-

abilities than the conventional detection method. Even under dif-

ferent types of attacks, the intrusion detection performances based

on the proposed CFAR detectors shows consistent improvement.

Index Terms—Cell-averaging (CA-CFAR), constant false

alarm rate (CFAR), Dempster–Shafer, detector fusion, intrusion

detection, network trafﬁc model, optimal CFAR, order statistics

CFAR (OS-CFAR).

I. INTRODUCTION

ITH THE fast increase of network connections, the

problem of intrusion detection becomes more and more

important [1]. Although the Internet service can provide useful

information due to its open property, it should also be noticed

that the number of network intrusions increases faster than

before, which introduces a lot of inconvenience to the users

[2]. Nowadays, computer network trafﬁc is inﬂuenced by many

kinds of intrusions such as attacks, viruses, worms, etc. Some

of these intrusions might not cause serious damages, but most

of them will bring an unexpected inﬂuence to the servers or

personal users [3], [4].

Misuse detection and anomaly detection are two basic cate-

gories of intrusion detection techniques [5]. Misuse detection

is a kind of passive method that is used to avoid known

intrusions [6]. By using misuse detection, patterns of differ-

ent intrusion signals should ﬁrst be studied [7]. Detection is

then carried out through some pattern recognition techniques

Manuscript received January 10, 2007; revised June 25, 2007. This work was

supported in part by the Natural Science and Engineering Council of Canada,

by the Natural Science Foundation of China under Grant 60272082, and by the

Scientiﬁc Research Foundation for the Returned Overseas Chinese Scholars,

State Education Ministry of China.

D. He is with the Department of Electronic Engineering, Shanghai Jiao Tong

University, Shanghai 200240, China (e-mail: dihe@sjtu.edu.cn).

H. Leung is with the Department of Electrical and Computer Engi-

neering, University of Calgary, Calgary, AB T2N 1N4, Canada (e-mail:

leungh@ucalgary.ca).

Color versions of one or more of the ﬁgures in this paper are available online

at http://ieeexplore.ieee.org.

Digital Object Identiﬁer 10.1109/TIM.2007.910108

[8], [9]. Although misuse detection is widely used in many

current systems, its weakness is that it is invalid to detect new

attacks. Anomaly detection does not suffer from this problem,

but it is usually found to have a lower probability of detection

[10]–[12]. Although various sophisticated techniques such as

neural networks [13], hidden Markov model [14], integrated

access control [15], and sensor fusion [16] have been inves-

tigated, these techniques either cannot fulﬁll the requirement

for real-time detection or are unable to achieve high detection

probabilities for different types of intrusions. Hence, a robust

anomaly detector with an acceptable detection probability is

still in need.

Most reliable detectors in use to date, such as those for

radar systems, are based on the statistical decision theory. To

develop a robust network intrusion detector, understanding the

distribution model of network trafﬁc is important. It has been

found that the normal trafﬁc obeys some certain distributions

when there is no intrusion [17]–[19]. When attacks occur, the

statistical properties of the process may change. It indicates that

anomaly detection that is based on abrupt-change detection is

a reasonable approach. To capture this property for detection,

prediction-based methods have been considered [20]. By com-

paring the prediction values with the real ones, the prediction

error becomes another vital indication for the appearance of

intrusion signals.

In this paper, we propose the application of a robust radar

detection approach, which is the constant false alarm rate

(CFAR) technique, to the prediction-based abrupt-change de-

tector for network intrusion detection. In particular, three

popular CFAR techniques, namely, the order statistics CFAR

(OS-CFAR) [21], the cell-averaging CFAR (CA-CFAR) [22],

and the optimal CFAR [23], are considered here due to their

good detection performances. Detection probabilities of the var-

ious CFAR detectors are derived. In addition, we propose fusion

of these CFAR detectors to enhance the detection performance.

Bayesian and Dempster–Shafer fusion methods are applied to

achieve a reliable fused CFAR detector. The simulation results

that are based on the standard Defense Advanced Research

Projects Agency (DARPA) data sets conﬁrm the theoretical

results and indicate that the proposed CFAR approach is ef-

fective in detecting network intrusion even under different

attacks.

This paper is organized as follows. Section II brieﬂy dis-

cusses the network trafﬁc models. The error of the abrupt-

change detector that is based on the autoregressive (AR) model

is shown to follow a Gaussian distribution. Section III presents

the CFAR techniques, including OS-CFAR, CA-CFAR, optimal

CFAR, and fused multiple CFAR methods that are based on the

下载后可阅读完整内容，剩余7页未读，立即下载

weixin_38550334

粉丝: 2
资源: 952

CFAR检测器提升网络入侵检测性能：融合与优化策略

CFAR.rar_CA-CFAR信号检测_CFAR_cfar 目标检测_信号检测_恒虚警CFAR

分布式OSCA-CFAR检测系统的检测性能.pdf

使用随机共振CFAR技术的网络入侵检测

基于ARMA模型的CFAR网络入侵检测方法研究

基于matlab模拟CFAR理想检测门限、单元平均CFAR检测门限、审核式CFAR检测门限、有序统计CFAR检测门限 .zip

基于检测单元统计量的SOS-CFAR检测器

CFAR_CFAR目标检测_CFAR_恒虚_

双参数cfar检测器 matlab仿真程序

CFAR.rar_CFAR algorithm_CFAR检测_CFAR检测 matlab_matlab cfar 3-D

CFAR.zip_CFAR_cfar 目标检测_cfar技术_恒虚警_雷达目标检测

最新资源