入侵检测协作检测模型的分析与评估

Analysis and evaluation of collaborative intrusion detection model

目前,入侵检测系统(IDS)存在较高的误报率,这一直是困扰IDS用户的主要问题,而入侵检测系统主要有误用型和异常型两种检测技术,根据这两种检测技术各自的优点,以及它们的互补性,将两种检测技术结合起来的方案越来越多地应用于IDS。通过引入入侵检测能力,从理论上深刻解释了系统协作的必然性,提出了异常检测技术和误用检测技术相结合的IDS模型及其评估方法,降低了单纯使用某种入侵检测技术时产生的误报率,从而提高系统的安全性。

At present, Intrusion Detection System （IDS） has the high false positive rate, ant it has always been a major problem to the IDS user. IDS mainly has two detection technologies： misuse detection and anomaly detection. According to two detection technologies＇ benefits, as well as their complementary, the collaborative detection is increasingly applied to IDS. By introducing the intrusion detection capability in theory, this paper profoundly explained the necessity of collaborative system, proposed the collaborative IDS model combined anomaly detection with misuse detection and its evaluation method. This model had lower false positive rate than using only one intrusion detection technology, thereby improved the system＇s security.