计算机工程与应用 ›› 2010, Vol. 46 ›› Issue (27): 88-92.DOI: 10.3778/j.issn.1002-8331.2010.27.024

• 网络、通信、安全 • 上一篇    下一篇

Snort入侵检测系统中的规则泛化模型

李凯斌,李明楚,覃振权,田琳琳   

  1. 大连理工大学 软件学院,辽宁 大连 116620
  • 收稿日期:2009-05-22 修回日期:2009-07-12 出版日期:2010-09-21 发布日期:2010-09-21
  • 通讯作者: 李凯斌

Rule generalization model for Snort intrusion detection system

LI Kai-bin,LI Ming-chu,QIN Zhen-quan,TIAN Lin-lin   

  1. School of Software Technology,Dalian University of Technology,Dalian,Liaoning 116620,China
  • Received:2009-05-22 Revised:2009-07-12 Online:2010-09-21 Published:2010-09-21
  • Contact: LI Kai-bin

摘要: 针对Snort系统不能检测新的入侵行为的缺点,提出一种基于规则泛化的Snort入侵检测系统的改进模型。该模型结合Snort规则的特征和数据挖掘中的知识,提出聚类泛化和最近邻泛化两种新的规则泛化方法来改进规则,增强Snort的检测能力,从而达到识别更多入侵行为的目的。实验结果表明:在不显著增加误报率的前提下,采用规则泛化的Snort能够检测出原来系统不能发现的入侵行为,提高检测率达8.2%。

Abstract: A new model for Snort intrusion detection system based on the theory of rule generalization is proposed to solve the problem that Snort system is powerless to find new types of intrusions.In the new model,combining the characteristics of Snort rules and algorithms in data mining,both cluster generalization and nearest neighbor generalization are also proposed to enhance the detection ability of rules and achieve the goal of detecting more intrusions.The test results show that,under the premise of no significant increase in false alarm rate,new types of intrusions can be detected by our model,and the detection rate has been increased by 8.2%.

中图分类号: