MAIDS-多检测技术的IDS模型

目前,入侵检测系统的漏报率和误报率高一直是困扰IDS用户的主要问题,而入侵检测系统主要有误用型和异常型两种检测技术。针对这一问题,根据这两种检测技术各自的优点,以及它们的互补性,将两种检测技术结合起来的方案越来越多地应用于IDS中。论文提出了基于统计的异常检测技术和基于模式匹配的误用检测技术及其它检测技术相结合的IDS模型-MAIDS,以期达到减少入侵检测系统的漏报率和误报率的目的,从而提高系统的安全性。

MAIDS-Model of IDS with Multi-Technology

Currently,the false positive and the false negative of Intrusion Detection System are very high.It is always the main problem that bothers the user of IDS.But there are two main technologies applied in IDS.To this problem, because both the technologies have its own advantages and they can supply for each other.So IDS combined with the two technologies is used more and more widely.This paper presents a model of IDS based on combination of Misuse Detection,Anomaly Detection and other detection technologies called MAIDS.In this model,Misuse Detection is based on pattern matching and Anomaly Detection is based on statistical analysis.It combines the two technologies to reduce the false positive rate and the false negative rate,and then to improve security of IDS.