討論了將數(shù)據(jù)融合技術(shù)運(yùn)用到入侵檢測(cè)系統(tǒng)中的方法，并提出了一個(gè)基于數(shù)據(jù)融合技術(shù)的入侵檢測(cè)機(jī)制－DFIDM。在該機(jī)制中，有多個(gè)檢測(cè)器搜集系統(tǒng)日志文件、網(wǎng)絡(luò)流量信息、網(wǎng)絡(luò)數(shù)據(jù)包等數(shù)據(jù)，這些數(shù)據(jù)在通過(guò)了本地決策、數(shù)據(jù)提取和對(duì)象提取階段等預(yù)處理過(guò)程之后，傳送到融合中心進(jìn)行決策，重點(diǎn)研究了決策過(guò)程所涉及的多參數(shù)問(wèn)題。為此，系統(tǒng)設(shè)計(jì)了檢測(cè)器可靠性、時(shí)間因素、空間因素等五個(gè)主要因素參與融合與決策。最后通過(guò)實(shí)驗(yàn)證明，采用了該機(jī)制的入侵檢測(cè)系統(tǒng)具有更好的準(zhǔn)確性。

This paper introduces a method of Intrude Detection Based on Data Fusion, and presents a new mechanism –DFIDM. In DFIDM, a few of sensors are configured to collect data, such as log file, information of Network Traffics and data package of network. After some pretreatments such as local decision-making, Data Refinement, Object Refinement, these data will be transferred to fusion center. In this paper, we mostly research the multiple parameters of final decision-making, such as reliability of sensors, the factor of time, the factor of space. As it showed by the research result this mechanism can improve the veracity of IDS.