基于同步点的IDS评估评分方法

SyncPoint based scoring method in IDS evaluation

评分方法是判定IDS的检测率和误报率的重要环节,评分方法的准确性直接影响评估结果的有效性。现有的考虑误报和不考虑误报的评分方法均存在不同程度的准确性误差,并且不能适应日益增加带宽下的流量需求。分析了评分方法的判定窗口所需要的性质,并基于IDS对报文处理的FIFO队列特性,提出了基于同步点的评分方法。经过理论证明和实验验证,这个新方法相对于现有的评分方法有更高的准确性和更好的可扩展性。

Scoring the true positive rate and the false positive rate is a key component in IDS evaluation. The accuracy of the scoring method affects the effectiveness of the evaluation results. There are two kinds of scoring methods existed, one considering the false positive and the other not. But both of them aren＇t accurate enough and don＇t scale to the traffic volume increase. The characteristics required by the evaluating window was analyzed, and a SyncPoint based scoring method utilizing the features that the IDS processes the packet in a FIFO queue way was proposed. The theoretical analysis and the experiment show that the SyncPoint based scoring method is better than the current methods in accuracy and the scalability.