网络入侵检测系统预先决策检测引擎研究

为了减少基于特征的网络入侵检测系统产生的虚警数量并提高其检测效率,提出了一种采用预先决策检测引擎的方法,该方法把受监控网段内的主机软件信息作为预先决策检测引擎的决策依据,在模式匹配之前进行预先决策,过滤掉不需要匹配的入侵规则,使得单个数据包平均模式匹配次数尽可能少,从而降低虚警数量并改善检测性能.实验结果表明,该方法在不增加网络入侵检测系统漏报率的前提下,能够减少虚警数量,并改善系统的检测效率.

Pre-decision detection engine for signature-based network intrusion detection system

A pre-decision detection engine to mitigate false positives generated by signature-based network intrusion detection system and improve the performance of processing packets was proposed.By utilizing hosts'software information on monitored network,predecision detection engine makes a decision before pattern match to filter out unnecessary rules,which minimizes average pattern-match times for each packet,and reduces false positives and improves performance as a result.Experimental results showed that pre-decision detection engine can decrease false positives and improve the performance of processing packets,without increasing the false negative rate.