入侵检测语言的评估

Evaluation Method for Intrusion Detection Language

入侵检测语言是入侵检测系统用于定义攻击场景的表示规范.提出一种比较和评估入侵检测语言的方法,该方法建立在一个可被证明是互斥和完备的分类基础上,并基于表达能力、表示简洁性、检测强度等三个测度.使用该方法可以对现有的各类检测语言表示攻击特征并进行推理的相对有效性进行评估,从而揭示出现有检测语言的缺陷和理想的入侵检测语言应具有的特性.

Intrusion detection language is an expression specification used by IDS to describe the intrusion senarios. Based on a mutually exclusive and exhaustive taxonomy of network attacks and their detection languages, this paper proposes an evaluation method for intrusion detection languages with three metrics：expressibility,representational succinctness and detection intensity. Those well-known detection languages have been evaluated using this method in terms of their ability to express attack signature and their detection efficiencies, so as to reveal their shortages and the features that an ideal detection language should have.