基于协议分析的散列模式入侵检测方法

Intrusion detection approach using protocol analysis-based hash pattern

对网络入侵检测系统的工作方式和常用模式匹配算法进行分析,给出了一种基于协议分析的高效散列模式方法,并使用应用层协议的分析,利用多层次的散列表来构造检测规则集的模式树。在目前网络流量不断增大、入侵特征规则数量迅速增加的情况下,可以有效地提高网络入侵检测系统的工作效率并降低误报率。

An intrusion detection approach was proposed, which analyzed the application layer protocol and used multi-layer hash list to construct pattern tree of detection rule database. When the flow of network and the amount of the rules of intrusion detection based on signature are daily increasing, this new approach can definitely improve the work efficiency and decrease the false positive rate of network intrusion detection system.