网络环境下自适应入侵响应系统的研究

Research on adaptive intrusion response system in network

目前,社会上对入侵检测系统产品的开发设计研究得很多,而对入侵检测系统的性能进行综合评价以及评价指标的研究很少。本文利用入侵响应警报矩阵,对入侵检测系统的性能指标进行了分析,对检测正确率、漏报率、误报率、警报可信度和IDS效率进行了分析。利用数学方法分析了入侵检测系统的警报可信度、攻击频率、风险评估和响应成本,对自适应入侵响应系统的损失评估和响应成本进行了数学分析,对入侵响应策略进行了研究,而且对根据环境变化动态调整安全策略的自适应入侵响应系统进行了研究。

Nowadays, there are many products of intrusion detection system, while research on the assessment of these products is rare. Based on the intrusion response alarm matrix, the paper analyzed the performance index of the intrusion detection system, the probability of correction for inspect, false positive, false negative, alarm reliability and IDS efficiency. It takes a mathematical analysis of the alarm confidence level, the attack frequency, the risk assessment and the response cost of IDS, analysis of the tactic of IRS. Research on adaptive intrusion response system （AIRS） that is able to make automated response and adjust security policies according to the environmental variation dynamically is made.