基于数据挖掘的Snort系统改进模型

针对Snort系统对新的入侵行为无能为力的缺点，设计了一种基于数据挖掘理论的Snort网络入侵检测系统的改进模型。该模型在Snort入侵检测系统的基础上增加了正常行为模式挖掘模块、异常检测引擎模块和新规则生成模块，使得系统具有从新的入侵行为中学习新规则和从正常数据中学习正常行为模式的双重能力。实验结果表明，新模型不仅能够有效地检测到新的入侵行为，降低了Snort系统的漏报率，而且提高了系统的检测效率。

An improved model of Snort system based on data mining

An improved model of the Snort network intrusion detection system based on the theory of data mining was proposed, regarding the problem that Snort is powerless to new types of intrusion. In the new model, normal behavior patterns mining module, anomaly detection engine module and new rules generating module were added to the Snort system. By these improvements the system has double capacity of learning rules from new intrusions and learning normal behavior patterns from normal data. The test result shows that new types of intrusion can be detected effectively, the false negative of Snort can be reduced, and the detection efficiency of the system has been enhanced.