Research of the Dynamical Rule Generation for Intrusion Detection System
Shengfeng Tian · Journal of Beijing Jiaotong University · 2008
In the research of the network intrusion detection,it is an important topic to improve detection rate and reduce false positive rate.In this paper,a novel real-time and dynamical rule generation method for network intrusion detection stream was proposed.This method solves a number of problems of the popular association rules extraction method that exist in applying association rules algorithm to the intrusion detection:multi-scan;a lot of useless rules;a lot of unwanted frequent sets.Experimental results have demonstrated the good performance between building efficacious rules and detecting the abnormal attack events.Comparing the detecting accuracy and the detecting anomaly attack events with the Snort intrusion detection system,It can improve 10% or so averagely and overcome the shortage of the detecting anomaly event of the Snort system.