Research on Intrusion Detection System Based on CBR Technology
Lei He · Journal of Information Engineering University · 2011
At present,mature commercial intrusion detection systems usually adopt precise matching based on features or rules.If an attack mode is too special or an attacker adopts some evading detection techniques,it will lead to high false positive or false negative,thereby reducing the accuracy of whole system.To solve those problems,this paper proposes an intrusion detection system model based on case-based reasoning,then puts forward the pretreatment model based on snort to avoid the problem of excessive consumption of system resources caused by reasoning,and uses layered structure case base maintenance model to solve the problems of case quality and access speed,designs an improved matching algorithm based on variable weights for CBR engine to improve searching accuracy.Simulation results show that the above system can solve the problem of evading detection successfully and has been improved in detection rate compared with traditional systems.