入侵防御系统管理和配置的检查博弈分析

Inspection game analysis of intrusion prevention system management and configuration

入侵防御系统(IPS)是当前信息安全领域的一种新的技术手段,其配置和管理是目前急需解决的问题.应用检查博弈对入侵防御系统进行分析,得出如下结论:当误报率和正确报警概率的和大于1时,IPS 应设置成主动防御模式,也就是不进行人工调查,由 IPS 自动阻断攻击;反之,IPS 应设置成经人工调查后,由 IPS 阻断攻击的模式.IPS 正确报警的概率也不是越高越好,应该设置在临界值和1之间.

At the present time, intrusion prevention system （IPS） is a new kind of information security technology measure, whose management and configuration have become an urgency problem recently. In this paper, through the analysis of inspection game some interesting conclusions are obtained. When the sum of accurate alarm rate and false alarm rate is more than 1, IPS should be set as the mode of initiative prevention, which means that IPS can block attacks automatically without investigation. Contrarily, the prevention of IPS needs investigation. During the configuration of IPS, the accurate alarm rate of IPS should be located between the critical value and 1.