CAJ | 학술논문

针对基于网络的入侵检测系统Snort,提出了一种新颖的规则挖掘方法.这种方法希望帮助Snort入侵检测系统,自动从检测的攻击数据中生成误用检测规则,实现自动检测最新攻击和异常攻击的能力.为了达到这样的功能,设计了一个规则挖掘模块,它能够应用数据挖掘技术从收集的检测攻击包中提出新的攻击规则,并且转化到Snort系统的检测规则模式用来进行在线入侵检测.在KDD-99数据集的试验结果表明,该方法适合实时规则挖掘,并且通过提供高精度的入侵检测和低误报率的正常网络数据流检测而超越了其他分类方法.
침대기우망락적입침검측계통Snort,제출료일충신영적규칙알굴방법.저충방법희망방조Snort입침검측계통,자동종검측적공격수거중생성오용검측규칙,실현자동검측최신공격화이상공격적능력.위료체도저양적공능,설계료일개규칙알굴모괴,타능구응용수거알굴기술종수집적검측공격포중제출신적공격규칙,병차전화도Snort계통적검측규칙모식용래진행재선입침검측.재KDD-99수거집적시험결과표명,해방법괄합실시규칙알굴,병차통과제공고정도적입침검측화저오보솔적정상망락수거류검측이초월료기타분류방법.
A novel rule miner method was proposed for Snort network-based intrusion detection system（NIDS）.This method firstly wish to help the Snort NIDS to automatically generate rules from detection attack data,and implement the ability of detection novel and abnormal attack behaviors.On the other hand,a rule miner module is implemented by applying data mining technique to extract new attack rules from attack packages collected,and convert the patterns to Snort detection rules for on-line intrusion detection.The experimental results on KDD-99 dataset show that the proposed method is suitable for real-time rule mining,and outperforms other classifier methods by providing the highest detection accuracy for intrusion attacks and low false rate for normal network traffic.