Performance Evaluation of a Collaborative Intrusion Detection System
Chunfu Jia, Deqiang Chen · 2009
There are two technologies in intrusion detection systems: misuse detection and anomaly detection. Both misuse detection and anomaly detection have advantages and disadvantages. At present, the intrusion detection system is developed by using these two technologies in conjunction with one another, but there is not an effective method to evaluate the intrusion detection systems collaborative detection's performance. It is necessary to analyze it by establishing a strictly mathematical assessment equation. Considering the information theory method to analysis this problem, the intrusion detection capability can be used to analysis and evaluation. By contrast two intrusion detection systems, it turns out, the system that based on misuse and anomaly collaborative detection has the better detection effects.