基于协议分析的入侵检测规则智能匹配  

Intelligent Matching for Intrusion Detection Rules Based on Protocol Analysis

作　　者：于志宏[1] 赵阔[1] 胡亮[1] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012

出　　处：《吉林大学学报（信息科学版）》2008年第2期156-162,共7页Journal of Jilin University（Information Science Edition）

基　　金：国家自然科学基金资助项目(60473099);教育部新世纪优秀人才支持计划基金资助项目(NCET-06-0300)

摘　　要：针对传统模式匹配检测技术存在的计算量大、检测率低误、报警率高等问题,提出了一种基于协议分析的智能匹配检测方法。该检测方法充分利用TCP/IP(Transmission Control Protocol/Internet Protocol)技术的高度规则性检测攻击的存在,明显减少了匹配检测的计算量。设计并实现了基于动态分析的自动排序规则库。实验结果表明,该智能匹配方案能使模式匹配的时间缩短20%,从而提高了入侵检测的效率。Because there are some problems for traditional pattern matching detection technique such as high strength computations, low detection rates and high false alarm rates an intelligent matching for intrusion detection rules based on protocol analysis is proposed. And this technique aims at detecting attacks by the means of high regularity of TCP/IP （Transmission Control Protocol/Internet Protocol） , which results in obvious decrease of computational quantities of rules matching. The design and implementation of auto sorting rules base based on dynamic analysis are also presented. Experimental results show that our proposals can shorten about 20% the time of pattern matching and improve the efficiency of intrusion detection.

关 键 词：协议分析 模式匹配 入侵检测 

分 类 号：TP31[自动化与计算机技术—计算机软件与理论]