网络入侵检测与漏洞扫描协作研究

Research on collaboration between network intrusion detection and vulnerability scanning

入侵检测系统是现今网络信息安全研究的热点,普通的网络入侵检测系统有较高的误报率,为了减少误报率并提高检测效率,首先在入侵检测系统的分析引擎中采用将异常检测和误用检测结合起来降低入侵检测系统的误报率和漏报率,然后再通过漏洞扫描引擎过滤入侵检测系统中无效警报再次降低误报率,最后通过响应界面报警.

Nowadays intrusion detection system is a focus in research on network information security, but network intrusion detection system has a high false alarm rate. In order to reduce the false alarm rate of network intrusion detection system and improve detection efficiency, anomaly detection and misuse detection were first combined in analysis engine of intrusion detection system to reduce the false alarm rate and omission rate, then filtered invalid alerts through vulnerability scanner to reduce false alarm rate again, and finally gave a warning by the response interface.