基于关联规则的IDS规则库构建应用研究

入侵检测系统的检测性能很大程度上取决于规则库的更新.网络安全的日益严峻对入侵检测系统的规则提取提出了更高要求.提出了将关联规则算法运用于入侵检测系统规则库更新的设想,阐述了传统的关联规则算法,并针对其入侵检测系统中的应用进行改进.以Snort为例,详细描述了用改进的关联规则算法挖掘网络数据集,然后将结果转换为入侵检测规则的过程,并以实验说明了应用关联规则构建入侵检测系统规则库的可行性.

Application research of constructing IDS rules library based on association rules

The performance of network intrusion detection system(IDS)depends on upgrading of rules greatly. The serious security problems require better performance on upgrading rules. Applying association rules on updating of detective rules library in IDS is as- sumed. The traditional association rules algorithm is analyzed, and some improvement is done aimed at the IDS. By giving an example of Snort, the improved association rules algorithm is applied to mine the network dataset, and the result is translated into intrusion detective rules. The experiment shows feasibility of applying the association rules to construct the IDS rules Library.