Deep protocol analysis method in network intrusion detection
Zhenkun Wen · Jisuanji yingyong yanjiu · 2012
To research a reducing the rules redundancy method which can reflect the complexity and relation of rules in intrusion detection,this paper proposed a deconstructing network intrusion events method based on deep protocol analysis.Protocol analysis was not only applied to and hierarchically analyzed the network intrusion events,but also gone deep into the application layer data.Experiment results prove that the method can not only solve the above problems effectively with less false positive ratio(FPR) and false negative ratio(FNR),and less redundancy of rules,but also improve the speed of detection and adaptation to high-speed network.And it's also able to detect some unknown attacks.