Pattern build and matching method of intrusion detection
Lei Zhao · Jisuanji gongcheng yu sheji · 2009
Existing methods easily lead to the loss of key information and induce a higher false positives and false negatives. A special two phases clustering method and fuzzy profile tree pattern matching method are proposed , which build a fuzzy profile tree based on describe attributes, then do cluster within act attribute, finally, get a number of some action patterns of a certain type. Meanwhile, the fuzzy profile tree has the same function as decision tree. At the detection phase, according to this tree, a fuzzy clustering is built, then do precision match within this fuzzy clustering. This method is effective to protect the description information and behavior information, avoid the loss of key information and reduce the false positives and false negatives.