入侵检测规则动态生成研究

Research of the Dynamical Rule Generation for Intrusion Detection System

在入侵检测研究领域中,提高检测模型的检测率并降低误报率是一个重要的研究课题.本文提出了一种针对网络入侵检测事务流的实时动态规则生成方法.该方法解决了当前主流关联规则生成算法应用到入侵检测过程中存在的多遍扫描、大量无效规则和频繁集产生等问题.实验结果表明,文中所提出的方法在规则动态生成和对网络异常情况的检测方面都显示出比较好的性能,相对Snort入侵检测系统,平均提高10%左右的检测精度,克服了Snort系统在异常检测方面的局部缺陷.

In the research of the network intrusion detection, it is an important topic to improve detection rate and reduce false positive rate. In this paper, a novel real-time and dynamical rule generation method for network intrusion detection stream was proposed. This method solves a number of problems of the popular association rules extraction method that exist in applying association rules algorithm to the intrusion detection： multi-scan;a lot of useless rules; a lot of unwanted frequent sets. Experimental results have demonstrated the good performance between building efficacious rules and detecting the abnormal attack events. Comparing the detecting accuracy and the detecting anomaly attack events with the Snort intrusion detection system, It can improve 10% or so averagely and overcome the shortage of the detecting anomaly event of the Snort system.