一种基于Snort规则和神经网络的混合入侵检测模型  

A hybrid intrusion detection model based on Snort rules and neural network

作　　者：刘明[1] 高玉琢[2] 

机构地区：[1]宁夏大学数学计算机学院,宁夏银川750021 [2]宁夏大学网络管理中心,宁夏银川750021

出　　处：《广西大学学报（自然科学版）》2011年第A01期110-115,共6页Journal of Guangxi University（Natural Science Edition）

基　　金：宁夏高等学校科研项目(NE20101029-08)

摘　　要：当前入侵检测系统的主要技术基本可以分为误用检测和异常检测两种,针对其在误报率和漏报率方面的不足,结合两种检测技术的特点设计了一种混合型入侵检测方案。先通过模式匹配算法对数据包进行初级检测和数据分流,然后将可疑数据送报高级检测引擎进行智能检测,再将结果反馈给初级检测引擎;相对单一的入侵检测技术,本模型提高了入侵检测系统的检测效率和准确率。Two main technologies of current intrusion detection system are misuse detection and anomaly detection. Facing with its rate of false report and misreport, a hybrid intrusion detection scheme based on the characteristics of the two kinds of technologies was designed. Firstly, packets are primary detected and divided by the pattern matching algorithm. Then, the data will be sent to the senior detection engine to go through an intelligent detection, and at last a feedback about the results will be given to the primary detection engine. Compared to the single intrusion detection technology, the model of IDS is more effective and accurate.

关 键 词：入侵检测 混合检测 误报率 漏报率 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]