Scheme of Optimizing Intrusion Detection System

方杰,许峰,黄皓

2005-01-01

Journal of Computer Applications

Abstract:Rule based intrusion detection system is the mainstream of intrusion detection systems. For every incoming network packet, a scheme of creating a single rule set for pattern match was discussed. This scheme could reduce the work of pattern match, and improve the efficiency of system.

What problem does this paper attempt to address?

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

LONG Xiao-fei,FENG Yan,WANG Rui-jie

DOI: https://doi.org/10.3785/j.issn.1008-973x.2006.10.009

2006-01-01

Abstract:A pre-decision detection engine to mitigate false positives generated by signature-based network intrusion detection system and improve the performance of processing packets was proposed.By utilizing hosts'software information on monitored network,predecision detection engine makes a decision before pattern match to filter out unnecessary rules,which minimizes average pattern-match times for each packet,and reduces false positives and improves performance as a result.Experimental results showed that pre-decision detection engine can decrease false positives and improve the performance of processing packets,without increasing the false negative rate.
On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

LIU Tong,WANG Ze-bing,FENG Yan

DOI: https://doi.org/10.3969/j.issn.1007-130x.2005.08.004

2005-01-01

Abstract:As the distributed intrusion becomes serious, the performance demand for distributed intrusion detection systems will be more and more important. In this paper, the concept of the Super-Peer intrusion detection model (SPIDM) is proposed. Furthermore, the technology of intelligent agent is implemented in this model. As a result, this efficient combination of distributed intrusion detection systems with the super-peer framework increases the system efficiency and collaboration, enhances the system openness, and thus improves the system performance as a whole.
An Intrusion Detection System Based on FRete Net Algorithm

Fei Yu,Renfai Li,Miaoliang Zhu,Bin Jiang

DOI: https://doi.org/10.1109/wcica.2004.1342337

2004-01-01

Abstract:Effective intrusion detection is necessary for system security. This paper describes an inference machine based on the FRete algorithm using the classic Rete algorithm, which can carry out intellectual reasoning on suspicious data in network. In order to improve the match efficiency of the inference machine, node in mode net is added into the inclusive brother's chain, the connection joint of the same production type in the network is divided into equivalence form according to variable restrain. Finally, a distributed intrusion detection system based on FRete network algorithm is realized.
Multi-agent based hybrid Intrusion detection system

张宝军,潘雪增,王界兵,平玲娣

DOI: https://doi.org/10.3785/j.issn.1008-973X.2009.06.004

2009-01-01

Abstract:Real-time intrusion detection under current network environment exists the following problems: first, the scale of network is large, and a great deal of information needs to be processed, which requires large throughput to the intrusion detection system (IDS); second, the network environment is complex, and the data type is multiplex, accordantly, the intrusion detection system should has high accuracy. Aiming at these problems, a model of intrusion detection system was proposed. The model uses the distributed architecture based on multi-agent system and shows good expansibility, and can self-adjust according to the scale and bandwidth of network. The model uses technologies of anomaly intrusion detection and misuse intrusion detection together, and has low false alert rate and miss alert rate. Multi-attribute data abstraction is used in the model to grasp the feature of intrusion accurately and provide strong support for intrusion identification. The classifier is constructed with radial basis function (RBF) so as to have good extension to unknown intrusions, and can do effective judgment to unknown intrusions. Experimental results show that the system has large throughput and high accuracy, thus it is suitable for current network and has good practicability.
Intrusion Detection And Simulation For High-Speed Networks

Fei Yu,XiaoPing Dai,Yue Shen,Huang Huang,Miaoliang Zhu

DOI: https://doi.org/10.1109/ICSSSM.2005.1500110

2005-01-01

Abstract:The problem in network security presently is how to get real-time intrusion detection and alert. In the paper, we design Intrusion Detection System architecture and arithmetic again, meanwhile put forward an improved pattern matching arithmetic based on protocol analysis and theorization machine on Frete. New architecture can use network processor to collect and analyze data in network bottom, which enhance the speed and efficiency in Detection System.
An Efficient Content-based Intrusion Detection System

张邈,徐辉,潘爱民

DOI: https://doi.org/10.3969/j.issn.1000-3428.2003.19.041

2003-01-01

Abstract:The efficiency of content-based intrusion detection systems, the structure of the signature library, the string matching algorithms and the analysis of application level protocols, has been regarded as the most crucial topic for extensive research. This paper introduces SpeedlDS, an efficient experimental content-based IDS. After an overview on several important aspects of design and implementation in which SpeedlDS distinguishes itself from other IDSs are particularly discussed. Experiments are also presented to test the effectiveness and results are proved promising by excelling Snort, a famous and widely used IDS.
An Online Rule Generation Model for Intrusion Detection

GUO Shan-Qing,XIE Li,ZENG Ying-Pei

DOI: https://doi.org/10.3321/j.issn:0254-4164.2006.09.003

2006-01-01

Abstract:Progress has been made in using machine learning techniques such as SVM and neural networks for intrusion detection,but the non-understandable detection results have prevented those algorithms from being thoroughly utilized.In this paper,the authors put forward a novel huge-data oriented method,which was based on the popular association rules extraction algorithm and targeted at the result of intrusion detection,to build real-time rules for enhancing the understanding of detection results and therefore decrease possible loss.The algorithm,by introducing local support,global confidence,CI-Tree and IX-Tree structure,employed these tree structures to build online rules for currently active intrusion.This algorithm solved a number of problems that exist in applying association rules algorithm to intrusion detection:(1)multi-scan(twice at least);(2)mass useless rules due to unbalanced distribution of attacking data;(3)unwanted frequent set produced in the old two-phase rule-building method.Experimental results have demonstrated the method's good performance in both rule building efficacy and time efficiency.
Intrusion Detection for High-Speed Networks Based on Producing System

Ken Chen,Fei Yu,Cheng Xu,Yan Liu

DOI: https://doi.org/10.1109/WKDD.2008.87

2008-01-01

Abstract:This paper firstly analyzed the front pattern matching algorithm of intrusion detection system, and improved on the pattern matching algorithm. Having immediately analyzed Rete algorithm and aimed at its shortage, the paper introduced the FRete net algorithm on the basis of Rete net algorithm constituting an inference machine based on FRete matching algorithm, which could infer logical suspicious facts. Then the authors discussed and designed an intrusion detection system based on high-speed networks, and finally established a simulation and experiment platform to test the performance of IDS
Network Data Classification Mechanism for Intrusion Detection System

Shuai Jiang,Xiaolong Xu

DOI: https://doi.org/10.1109/CSCWD49262.2021.9437645

2021-01-01

Abstract:Intrusion detection system (IDS), as a network security device, monitors network data in real time and responds actively when it detects suspicious transmissions. However, suffered from the large amount of redundancy and high correlation of network data, the traditional IDS have defects in low detection rate and high computational overhead. In this paper, we propose a network data classification m...
Network Intrusion Detection Method Based on Rough Set Theory

Weitong CHEN,Yuntao QIAN

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.16.050

2006-01-01

Abstract:This paper presents a network intrusion detection method based on Rough Set theory,and use a hybrid method with genetic algorithm to find a possibly short reduct which can reduce computing time.The result of the experiment shows that this model has high detection rate and low false reject rate in detecting DoS and probe attacks,and performs well in detecting R2L and U2R attacks either.
The Evolving Intrusion Detection System

LIN Guo-Yuan,HUANG Hao,ZHANG Yong-Ping

2008-01-01

Computer Science

Abstract:Intrusion detection system is an important device of information security.In this paper,firstly,the current research on intrusion detection system is summarized in detail,and new characters are pointed out includes the adoption of intelligent algorithms,data fusion technology,alerts correlation algorithms,the variety of data sources and the collaboration with other security devices.Secondly,the recently work of testing and standardization about intrusion detection system is expounded.Finally,some directions for future research are addressed.
Design and Implementation of a Distributed Cooperative Intrusion Detection System

段海新,吴建平

DOI: https://doi.org/10.13328/j.cnki.jos.2001.09.015

2001-01-01

Ruan Jian Xue Bao/Journal of Software

Abstract:An integrative taxonomy for intrusion detection technologies is proposed, which can specify accurately existing intrusion detection methods. Aiming at multiple-domain environments, a distributed cooperative intrusion detection system (DCIDS) is designed, which implements cooperative intrusion detection through efficient, secure information exchange among IDSes in different domain. The architecture of intrusion detection systems is described, as well as its four components: sensor, analyzer, manager and user-interface. Some key issues are also discussed, including secure communication and selection of detection places.
Research and Design of Intrusion Detection Systems Based on SNMP

Xiao He

2010-01-01

Abstract:This paper analyzes the current methods commonly used in intrusion detection and network intrusion attacks,based on an SNMP-based Intrusion Detection System protocol design.Through reading and analyzing Management Information Base(MIB) of the network connection information,aiming at the characteristics of network intrusion and attacks,The program monitoring the network.The system consists of six modules,to realize network intrusion detection.
State Encoding for Multi-Pattern Matching for Network Intrusion Detection

WU Bihai,ZHAO Youjian

DOI: https://doi.org/10.3321/j.issn:1000-0054.2009.04.040

2009-01-01

Abstract:A state encoding scheme was developed to reduce the storage for the Deterministic Finite Automaton(DFA) in hardware-based Network Intrusion Detection System(NIDS).The scheme greatly reduces the number of transitions by re-encoding the DFA states so that multiple states can be represented by one number and transitions with the same input to the next state can be combined into one transfer.Theoretical analyses prove that this state encoding scheme minimizes the number of transitions while maintaining the best worst case DFA performance.Experiments on a mainstream NIDS rule set show that the state encoding scheme reduces the transitions by more than 98.9%.
Analysis,Improvement and Redevelopment of the snort

YANG Tong,QIAO Xiang-dong,ZHENG Lian-qing

DOI: https://doi.org/10.3969/j.issn.1009-3516.2008.02.021

2008-01-01

Abstract:Snort,one of the best Open Source Network Intrusion Detection Systems,is analysed in detail,in this paper,for the sake of searching network intrusion detection system.Then a solution is proposed to eliminate the redundancy of snort's rule chain.Experiments are done,which show that the solution proposed is correct and effective.Finally,on the basis of ARP technology approach,NIDS is developed with the improved snort as kernel module.Its excellent performance proves the solution to be valid once again.
Snort Rule Set Structure Method Based on Frequency

ZHOU Yu,TAN Xiao-bin,HE Xian-zong,XI Hong-sheng

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.12.053

2010-01-01

Abstract:A method of establishing rule set of snort based on frequency is proposed to enhance the efficiency of rule matching of snort intrusion detection system.Snort system analyzes network packets using rule set to find intrusion behaviors.A method is proposed which creates rule trees by the principle of low frequency first matching after calculating the frequency of each packets option,to decrease matching times and raise efficiency.By analysis of experimentation,it is proved that method based on frequency combined with parameter set archives excellent effects and enhances matching efficiency compared with Snort2 method.
Rule Generalisation in Intrusion Detection Systems Using Snort

Uwe Aickelin,Jamie Twycross,Thomas Hesketh-Roberts

DOI: https://doi.org/10.1504/ijesdf.2007.013596,

2007-01-01

International Journal of Electronic Security and Digital Forensics

Abstract:Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks. An IDS's responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and SNORT is one popular and actively developing open-source IDS that uses such a set of signatures known as SNORT rules. Our aim is to identify a way in which SNORT could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current SNORT rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard data sets and show that we are able to detect previously undetected variants of various attacks.
RESEARCH AND IMPLEMENTATION OF INTRUSION DETECTION BASED ON HIERARCHICAL STRUCTURE

Yong ZHANG,De-yun ZHANG,Sheng-lei LI,Xu-xian IANG

DOI: https://doi.org/10.3969/j.issn.1000-1220.2001.01.011

2001-01-01

Abstract:In this paper the traditional intrusion detection technology is analyzed . analys and presents a intrusion detection framework based on hierarchical structure . The technologies such as agent、expert system、computer immunology、distributed system are integrated to construct a strong intrusion detection framework.
An integrated pattern recognition approach for intrusion detection

Amod Pandit,R Joe Stanley,Bruce McMillin

Abstract:Intrusion detection systems (IDS) attempt to address the vulnerability of computer-based systems for abuse by insiders and to penetration by outsiders. An IDS is required to examine an enormous amount of data generated by computer networks to assist in the abuse detection process. Thus, there is a need to develop automated tools that address these requirements to assist system operators in the detection of violations of existing security policies. In this research, an automated IDS is proposed for insider threats in a distributed system. The proposed IDS functions as an anomaly detector for insider system operations based on the analysis of the system's log files. The approach integrates dynamic programming and adaptive resonance theory (ART1) clustering. The integrated approach aligns sequences of log events with prototypical sequences of events for performing tasks and classifies the aligned sequences for intrusion detection. The system examined for this research is a Boots System for controlling the movement of boots from one place to another under specific security restrictions related to the boot orders. We present the proposed model, the results achieved and the analysis of an implemented prototype.
Research on Network Intrusion Detection Based on Data Mining

杨建华,蒋玉明,彭轮

DOI: https://doi.org/10.3969/j.issn.1008-0570.2009.24.011

2009-01-01

Abstract:In this paper an intrusion detection system based on data mining is proposed,and its main idea is to apply data mining methods to learn rules that can capture normal and intrusion activities from pre-processed audit data that contain network connection information. Put forward a method to improve the Apriori algorithm,whose I/O is quite surprising when scanning the database. To improve the method is feasible;the normal rules in the knowledge database in IDS are mined. And the experiment indicates that the model can produce new rules,which approve the validity and the feasibility of the IDS.

Scheme of Optimizing Intrusion Detection System

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

An Intrusion Detection System Based on FRete Net Algorithm

Multi-agent based hybrid Intrusion detection system

Intrusion Detection And Simulation For High-Speed Networks

An Efficient Content-based Intrusion Detection System

An Online Rule Generation Model for Intrusion Detection

Intrusion Detection for High-Speed Networks Based on Producing System

Network Data Classification Mechanism for Intrusion Detection System

Network Intrusion Detection Method Based on Rough Set Theory

The Evolving Intrusion Detection System

Design and Implementation of a Distributed Cooperative Intrusion Detection System

Research and Design of Intrusion Detection Systems Based on SNMP

State Encoding for Multi-Pattern Matching for Network Intrusion Detection

Analysis,Improvement and Redevelopment of the snort

Snort Rule Set Structure Method Based on Frequency

Rule Generalisation in Intrusion Detection Systems Using Snort

RESEARCH AND IMPLEMENTATION OF INTRUSION DETECTION BASED ON HIERARCHICAL STRUCTURE

An integrated pattern recognition approach for intrusion detection

Research on Network Intrusion Detection Based on Data Mining