Complete rule base of intrusion prevention system
Jie Wang, Zheng Xiao, Liu Ya-bin · Computer Engineering and Applications Journal · 2009
Regarding the characteristic that rule base of intrusion prevention system grows rapidly and is unable to complete,the paper proposes a complete rule base.Through the decomposition of network operation behavior and the data mining of various data,forms the most basic smallest unit of network operation behavio(rDNA of network action description) ,uses the Teiresias evolution algorithm to carry on the overall situation ergodicity combination to produce the new description language.After the feasible judgment,carries on the rule base matching and the risk assessment,then produces the new defense rule,thus reaches the goal of completing the rule base of IPS.