高速网络环境下一种对入侵检测系统的改进方法  

Improved method of High-speed Network Intrusion Detection System

作　　者：王阿婷[1] 毕红军[1] 刘云[1] 司夏萌[2] 

机构地区：[1]北京交通大学通信与信息系统北京市重点实验室,北京100044 [2]北京交通大学网络舆论安全研究中心,北京100044

出　　处：《铁路计算机应用》2010年第8期33-35,共3页Railway Computer Application

摘　　要：高速网络环境下,现有的入侵检测系统存在检测效率低、准确率低和丢包现象等问题。改进后的入侵检测系统先对数据包中的应用协议进行预处理,检测出比较明显的入侵特征。如果没有检测到,就利用基于决策树的模式匹配方法进行更进一步的检测。它可以提高检测速度和降低误报率,更加适应高速网络。In high-speed network, the Current Intrusion Detection System had some deficiencies ,like low efficiency, low accuracy, losing packets. Considering to improve the System, do pretreatment with the protocol in packet first, in order to detect the obvious features of the invasion. And then, it was adopted the decision tree theory to do further detecting. The proposed method had the higher performance, reduced false positives and made intrusion Detection System more suitable to highspeed network.

关 键 词：入侵检测 协议分析 决策树算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]