基于规则的IDS中的CBR研究

Research on CBR in Rule-Based IDS

本文在入侵检测系统(IDS)中引入基于案例的推理(CBR)来降低基于规则的精确匹配所造成的漏报率,有效地检测由已知攻击变异成的攻击。描述了实现 CBR 的步骤;给出了由规则设计和构造案例库的启发式方法;分析了实现 CBR 的有关算法;最后给出在入侵检测系统 Snort 上扩充 CBR 功能的实验结果。

In this paper the case-based reasoning （CBR） is introduced to reduce the false negative rate caused by rulebased precise matching in intrusion detection system and to detect the variation of known attack. The steps of implementing CBR are described, several illuminative methods for designing and constructing case-base from rules are proposed, and algorithms for implementing CBR are analyzed. Finally, the experiment results of applying CBR to Snort are shown.