带状态特征的检测规则及其在CIDF框架中的应用

Detection Rule with Intrusion Profile and Its Application in CIDF

通过对传统检测规则中的 if <条件> then <动作> 的修改，将入侵行为、阶段特征、入侵的后果影响进行量化，并与检测规则相联系，以提高对入侵的检测效率和响应效率，同时在这基础上给出CISL的一个规则描述上的扩充，并讨论其对A-Box和R-Box的设计需求。

This paper considers the intrusion behavior, phases and effects with the detection rule to get the more efficient detection and response. By changing the general rule sentence like if <condition> then <action>,it expands the description for detection rule with CISL in CIDF frame. Some design requirements for A-Box and R-Box are also discussed.