关键词: 粗糙集, 检测准确率, 属性约简, 决策树, 入侵检测, 误报率

Abstract: Aiming at the problems of high-dimensional massive data collected in the intrusion detection system, complexity and low accuracy by the model constructed by decision tree, the attributes of the network connections related with intrusion are selected because of the advantage about rough set, and then the model built by decision tree is used to classify the network connections in prediction, so a method for network intrusion detection has been developed, which is based on the attributes’ reduction of rough set and the predictive classification of decision tree hybrid in this paper. Experimental results show that the predominance has been proved, the accuracy has been improved in detecting DoS attacks largely and in detecting Probe and R2L attacks, at the same time, the rate of false alarm has been decreased notably.

Key words: rough set, intrusion accuracy, attribute reduction, decision tree, intrusion detection, rate of false alarm