Research on the Storage and Query of Base-XML Format IDMEF
Zhu Maosheng · Jisuanji gongcheng · 2002
As more and more information is exchanged in XML, IDS also uses XML to define IDMEF(Intrusion Detection Message Exchange Format)[1,2]. Because of the simplicity of the structure of IDMEF, general technology for the storage and query of IDMEF will incur more overheads, after analyzing the DTD of IDMEF, it is found to be convenient to store IDMEF by a stack. people may parse the DTD file to generate a stack, store this stack into relational DBMS, then can access or retrieve messages about intrusion alert. This strategy uses only two tables and is easy to be implemented. It is easy to apply this technique to other similar XML-format data. ;;;