Rule generalization model for Snort intrusion detection system
Zhenquan Qin · Computer Engineering and Applications Journal · 2010
A new model for Snort intrusion detection system based on the theory of rule generalization is proposed to solve the problem that Snort system is powerless to find new types of intrusions.In the new model,combining the characteristics of Snort rules and algorithms in data mining,both cluster generalization and nearest neighbor generalization are also pro-posed to enhance the detection ability of rules and achieve the goal of detecting more intrusions.The test results show that,under the premise of no significant increase in false alarm rate,new types of intrusions can be detected by our model,and the detection rate has been increased by 8.2%.