神经网络、遗传算法作为入侵检测系统
您好，我需要一些帮助来开始创建我的第一个算法；我想创建一个神经网络/遗传算法用作入侵检测系统。
但我正在努力解决一些问题（以前从未编写过算法）。
- 我想用 C# 进行开发，它可以作为控制台应用程序吗？如果是这样，作为一个先驱，该程序在最简单的形式下大约有多大。在 C# 中也可能吗？
- 如何连接程序从网络读取数据？以及如何将数据包转换为算法的可读数据。
- 如何让程序为 Snort 或其他形式的防火墙编写规则并阻止程序认为的潜在威胁。 （即，它发现来自 No.2 的威胁，然后将规则写入 Snort 规则页面，阻止特定流量）
- 如何跟踪数据。 （它阻止了什么，它观察它是如何得出这个结论的）
- 将其放置在网络上的哪里？ （该程序可以连接到其他算法并在同一网络上共享数据，这会有所帮助）
如果有人可以帮助我朝着正确的方向开始，或者解释还有哪些其他替代方案，例如模糊逻辑等，以及为什么它被视为黑匣子？
Hi I need some help on getting started with creating my first algorithm; I want to create a NN/Genetic Algorithm for use as an Intrusion detection system.
But I’m struggling with some points (never written an algorithm before.)
- I want to develop in C# would it be possible as a console app? If so, as a precursor how big would the programme roughly be, at its most simplistic form. Is it even possible in c#?
- How to connect the program to read in data from the network? Also how packets can be converted to readable data for the algorithm.
- How to get the programme to write rules for snort or some other form of firewall and block what the programme deems as a potential threat. (i.e it spots a threat from No.2 then it writes a rule into the snort rules page blocking that specific traffic)
- How to track the data. (what its blocked what its observing how it came to that conclusion)
- Where to place it on the network? (can the programme connect to other algorithms and share data on the same network, would that be beneficial)
If anyone can help start me off in the right direction or explain what other alternatives there are like fuzzy logic etc and why is it deemed as a black box?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，控制台应用程序和 C# 可用于创建神经网络。当然，如果您想要 UI 具有更多视觉效果，您将需要使用 WinForms/WPF/Silverlight 等。由于没有足够的信息来说明您想要做什么，因此无法判断程序有多大。此外，只要高效，尺寸就不应该成为问题。
我认为这是某种最后一年的项目？您使用什么类型的神经网络？您应该阅读一些有关使用神经网络进行入侵检测的学术论文/白皮书来获得一个想法。例如，此 PDF 包含一些信息：可能有帮助。
您应该一次迈出一步。创建神经网络与在 Snort 中创建新规则是分开的。一次只处理一个主题，否则你会不知所措。考虑到最困难的部分很可能是神经网络，您应该首先关注它。
不太可能有人会与您一起完成每一步，因为这是一个相当大的项目。展示您所做的事情并解释您需要帮助的地方。
Yes, a console app, and C#, can be used to create a Neural Network. Of course, if you want more visual aspects to the UI, you'll want to use WinForms/WPF/Silverlight etc.. It's impossible to tell how big the program will be as there's not enough information on what you want to do. Also, the size shouldn't really be a problem as long as it's efficient.
I assume this is some sort of final year project? What type of Neural Network are you using? You should read some academic papers /whitepapers on using NN with intrusion detection to get an idea. For example, this PDF has some information that might help.
You should take this one step at a time. Creating a Neural Network is separate from creating a new rule in Snort. Work on one topic at a time otherwise you'll just get overwhelmed. Considering the hard part will most likely be the NN, you should focus on that first.
It's unlikely anyone's going to go through each step with you as it's quite a large project. Show what you've done and explain where you need help.
当我开始学习神经网络时，我的核心认识是它们只是函数逼近器。我认为这是需要牢记的至关重要的一点。无论您使用的是遗传算法还是神经网络（或者如 @Ben Voigt 所提到的那样将它们组合起来，尽管神经网络通常与其他训练技术相关），您最终得到的是一个函数，您在其中放入了许多真实值并得到单个值。
记住这一点，您可以设计您的程序，并将网络视为在测试部分提供这些预测的黑匣子。在训练过程中，想象另一个黑盒子，你在其中放入成对的输入和输出对，并假设你向它展示的对越多，它就会变得越好。
也许你会觉得这微不足道，但考虑到与此类算法相关的所有理论和神秘行为，我发现将它们简化为这些类型的盒子令人放心（尽管有点令人失望；）。
My core realization when I started learning about neural networks is that they are just function approximators. I think that's a crucial thing to keep in mind. Whether you're using genetic algorithms or neural nets (or combining them as mentioned by @Ben Voigt, even though neural networks are typically associated with other training techniques) - what you get in the end is a function where you put in a number of real values and get out a single value.
Keeping this in mind, you can design your program and just think of the network as a black box providing those predictions, on the testing part. During training, think of another black box where you put in pairs of input and output pairs and assume it's gonna get better the more pairs you show to it.
Maybe you find this trivial, but with all the theory and mystic behaviour that's associated with this type of algorithms, I found it reassuring (though a bit disappointing ;) to reduce them to those kinds of boxes.