基于Snort的混合入侵检测系统的研究与实现

在分析研究snon系统的优缺点的基础上，利用其开源性和支持插件的优势，针对其对无法检测到新出现的入侵行为、漏报率较高以及检测速度较低等问题，在snon系统的基础上结合入侵检测中的数据挖掘技术，提出一种基于snort系统的混合入侵检测系统模型。该系统模型在snort系统原有系统模型基础上增加了正常行为模式构建模块、异常检测模块、分类器模块、规则动态生成模块等扩展功能模块。改进后的混合入侵检测系统能够实时更新系统的检测规则库，进而检测到新的入侵攻击行为；同时，改进后的混合入侵检测系统具有误用检测和异常检测的功能，从而提高检测系统检测效率。

Research and Implementation of Hybrid Intrusion Detection System based on Snort

Based on the analysis and research of the advantages and disadvantages of the system Snort,making use of its open source and supporting plug-ins,and combining with data mining technique of the current intrusion detection,the paper proposes a hybrid intrusion de- tection system model based on Snort.The model is created to solve the problems such as unable to detect the new intrusion,high missing re- port rate and lower detection rate.The system model adds extended fimction model such as normal behavior model construction module, anomaly detection module, classifier module, the rules dynamic generation module.The improved hybrid intrusion detection system could update the detection rules library,and realize the detection of new intrusion attacks;simultaneously,it increases the functions of misuse detec- tion and anomaly detection,and improves the system detection efficiency.