Research on CBR in Rule-Based IDS
Ling Li, Ru Wang · 2006
In this paper the case-based reasoning(CBR)is introduced to reduce the false negative rate caused by rule- based precise matching in intrusion detection system and to detect the variation o{ known attack.The steps of imple- menting CBR are described,several illuminative methods for designing and constructing case-base from rules are pro- posed,and algorithms for implementing CBR are analyzed.Finally,the experiment results of applying CBR to Snort are shown.