Design of a Distributed Intrusion Detection Model
Ming Yang · Jisuanji gongcheng · 2004
The traditional anomaly-based or misused-based intrusion detection usually makes a crisp choice between normality and anomaly. It loses much valuable information, which results in the poor detection efficiency, especially in the complex distributed network environment. To this problem this paper proposes a Fuzzy Decision Engine(FDE), a component of the detection agent in a distributed intrusion detection system, which can consider various factors based on fuzzy theory when an intrusion behavior is judged. The fuzzy comprehensive evaluation based distributed IDS with FDE is a hierarchical structure, which has the ability to analyze many types of information from the detection agents. Such an IDS has advantages of high accuracy of detection intrusion, an efficient decision-making process, as well as low consumption of system resource.