A Model of Rule Analysis Machine Based on Classification Tree in Misuse Detection
Daxin Liu · Jisuanji gongcheng · 2004
A graphical scheme is presented in order to resolve the problems that intrusion detection systems based on expert system slowly match the rules and cant keep up with high bandwidth of networks. The classification tree is used to build the rule analysis machine. The chosen sequence of the nodes is decided according to the effect the attributes in the attack description. The method of comparing characters of production rules is replaced with the traversing algorithm of trees. It effectively reduces the time of matching the attributes in the misuse detection systems, and meets the need of the real- time problem.