一种基于网络安全风险评估的入侵检测方法

针对传统的入侵检测系统存在报警数量大、误报率高等缺陷,提出了一种基于网络安全风险评估的入侵检测方法,该方法基于入侵检测结果,引入抗体浓度随入侵强度动态变化这一人工免疫理论的最新研究成果进行网络安全风险的计算,然后根据当前网络面临的实时安全风险动态设置报警策略。实验结果表明,该方法能够实时、定量地计算主机和网络所面临的风险,并极大地降低报警数量和误报率。

A Method of Intrusion Detection based on Network Security Risk Assessment

Traditional intrusion detection system faces the defects of huge alarm quantity and high false positives rate.In order to overcome the defects,a network security risk assessment-based intrusion detection method is proposed in this article.The method calculates network security risk uses the latest research results of artificial immune theory,which mainly include that the antibody concentration changes dynamic with strength of invasion.Then dynamicly set the alarm strategy based on real-time security risks faced by the current network.The experimental results show that the model can calculate host and network risk in real time and quantitative,the alarm quantity and the false positives rate is greatly reduced.