New data fusion model of intrusion detection——IDSFP
|更新时间:2024-10-14
|
New data fusion model of intrusion detection——IDSFP
Issue 6, Pages: 115-120(2006)
作者机构:
1. 河北大学数学与计算机学院
2. 河北大学数学与计算机学院,河北,保定,071002
作者简介:
基金信息:
DOI:
CLC:TP393.08
Published:2006
稿件说明:
移动端阅览
TIAN Jun-feng, ZHAO Wei-dong, DU Rui-zhong, et al. New data fusion model of intrusion detection——IDSFP[J]. 2006, (6): 115-120.
DOI:
TIAN Jun-feng, ZHAO Wei-dong, DU Rui-zhong, et al. New data fusion model of intrusion detection——IDSFP[J]. 2006, (6): 115-120.DOI:
New data fusion model of intrusion detection——IDSFP
摘要
以多传感器数据融合技术为基础
提出了新的入侵检测融合模型——IDSFP。其具有对多个IDS入侵检测系统的警报进行关联、聚合
产生对安全态势判断的度量
从而构成证据的特点。IDSFP应用D-S证据理论来形成对当前安全态势进行评估的信息
并动态地反馈、调整网络中各个IDS(intrusiondetectionsystem)
加强对与攻击意图有关的数据的检测
进而提高IDS检测效率
降低系统的误报率和漏报率。
Abstract
Based on multi-sensor data fusion technology
a new intrusion detection data fusion model-IDSFP was pre-sented.The model was characterized by correlating and merging alerts of different types of IDS
generating the measures of the security situation
thus constituting the evidence.Current security situation of network was evaluated by applying the D-S evidence theory
and various IDS of network were adjusted dynamically to strengthen the detection of the data which relates to the attack attempt.Consequently
the false positive rate and the false negative rate are effectively reduced
and the detection efficiency of IDS is accordingly improved.