摘要
在本文中,我们针对目前入侵检测系统普遍存在的误报率高、报警信息冗余现象严重和对入侵表述能力不强的缺陷,提出了一种基于入侵事件的检测分析技术,详细描述了该技术所采用主要方法的设计思想,如多传感器数据融合以及基于模糊规则的原始报警信息鉴别等。实验结果表明,同现有入侵检测系统相比,该技术大大降低了系统的检测成本。
In this paper, we present a detection technology based on intrusion events in order to overcome the shortcomings of high false alert rate, serious redundant alerts and poor expression about the intrusion activities in today＇s intrusion detection systems. We describe the design ideas about the important methods used in this technology such as multi-sensor data fusion, raw alert distinguishment based on fuzzy rules and so on in detail. Experimental results show that compared with the existing intrusion detection systems, this technology can reduce the system test cost greatly.
出处
《计算机工程与科学》
CSCD
2005年第8期13-15,34,共4页
Computer Engineering & Science
基金
国家自然科学基金重点资助项目(90104030)
关键词
入侵检测
数据融合
模糊规则
入侵通报
intrusion detection
data fusion
fuzzy rule
intrusion report
