分阶段K邻居模型(KNS)是一种可用于入侵检测系统中的数据挖掘模型。KNS先将节点状态分成不同的阶段,然后为每个节点查找同阶段内K邻居和不同阶段邻居,最后分别对阶段内部邻居和阶段邻居的相关属性进行统计挖掘,最终得到节点的阶段评价值。实验将KNS模型应用在基于WLAN数据包的入侵检测系统中,通过比较节点的阶段评价值是否异常判断是否存在入侵。结果表明,KNS可以快速地处理数据包并有效地检测攻击。
K-neighbor in sections is a data mining based model that can be applied in IDS. KNS will firstly divide nodes status set into several different sections. Then KNS will search k neighbors in the same section and neighbors between different sections for every node. At last KNS will get node's section score by mining statistics of properties of neighbors in sections and neighbors between sections separately. The KNS model is applied in WEAN frames based IDS in experiment and nodes' section score are used to determine whether there exits intrusion. The results indicate that KNS can handle frames rapidly and detect intrusions effectively.