关键词: 入侵防御, 规则库, 完备化, 网络行为描述DNA, Teiresias算法

Abstract: Regarding the characteristic that rule base of intrusion prevention system grows rapidly and is unable to complete，the paper proposes a complete rule base.Through the decomposition of network operation behavior and the data mining of various data，forms the most basic smallest unit of network operation behavior（DNA of network action description），uses the Teiresias evolution algorithm to carry on the overall situation ergodicity combination to produce the new description language.After the feasible judgment，carries on the rule base matching and the risk assessment，then produces the new defense rule，thus reaches the goal of completing the rule base of IPS.

Key words: intrusion prevention, rule base, completely, DNA of network behavior description, Teiresias algorithm