Rule-based Data Fusion Model of Intrusion Detection
Yuan Liu · Jisuanji gongcheng · 2005
Based on the the Cuppens’s CRIM model and the research results of IBM Zurich Research Laboratory, the paper proposes an intrusiondetection system(IDS) data fusion model in which the expert rule is applied. The defination of merging rate is given to measure the mergingefficiency. The algorithm in every part of the model is relatively similar, and therefore the system is easy to be implemented. The model can be usedto handle problems of false positive, false negative and too much number of alarms (caused by too small grannularity in detecting).