摘要： 通过对传统检测规则中的 if <条件> then <动作> 的修改，将入侵行为、阶段特征、入侵的后果影响进行量化，并与检测规则相联系，以提高对入侵的检测效率和响应效率，同时在这基础上给出CISL的一个规则描述上的扩充，并讨论其对A-Box和R-Box的设计需求。

关键词: 入侵检测, CIDF, 检测规则

Abstract: This paper considers the intrusion behavior, phases and effects with the detection rule to get the more efficient detection and response. By changing the general rule sentence like if then ,it expands the description for detection rule with CISL in CIDF frame. Some design requirements for A-Box and R-Box are also discussed.

中图分类号: 

• TP274.5