基于协议分析的入侵检测规则智能匹配

针对传统模式匹配检测技术存在的计算量大、检测率低误、报警率高等问题，提出了一种基于协议分析的智能匹配检测方法。该检测方法充分利用TCWIP（Transmission Control Protocol／Intemet Protocol）技术的高度规则性检测攻击的存在，明显减少了匹配检测的计算量。设计并实现了基于动态分析的自动排序规则库。实验结果表明，该智能匹配方案能使模式匹配的时间缩短20％，从而提高了入侵检测的效率。

Intelligent Matching for Intrusion Detection Rules Based on Protocol Analysis

Because there are some problems for traditional pattern matching detection technique such as high strength computations, low detection rates and high false alarm rates an intelligent matching for intrusion detection rules based on protocol analysis is proposed. And this technique aims at detecting attacks by the means of high regularity of TCP/IP （Transmission Control Protocol/Internet Protocol） , which results in obvious decrease of computational quantities of rules matching. The design and implementation of auto sorting rules base based on dynamic analysis are also presented. Experimental results show that our proposals can shorten about 20% the time of pattern matching and improve the efficiency of intrusion detection.