摘要： 在Cuppens的CRIM模型和IBM苏黎世研究实验室相关研究工作的基础上,提出了一种基于规则的入侵检测警报数据融合模型,并给出了其合成率的定义。该模型各个环节的处理方法具有良好的一致性,易于实现,可用于处理漏报、误报和警报数量过多(因警报粒度过细造成)的问题。
关键词:
入侵检测,
数据融合,
误报,
漏报,
合成率
Abstract: Based on the the Cuppens’s CRIM model and the research results of IBM Zurich Research Laboratory, the paper proposes an intrusiondetection system(IDS) data fusion model in which the expert rule is applied. The defination of merging rate is given to measure the mergingefficiency. The algorithm in every part of the model is relatively similar, and therefore the system is easy to be implemented. The model can be usedto handle problems of false positive, false negative and too much number of alarms (caused by too small grannularity in detecting).
中图分类号:
王开云,陈志文,姜建国,赵伟锋,高行宇,刘渊. 基于规则的入侵检测数据融合模型[J]. , 2005, 31(16): 145-146.
WANG Kaiyun, CHEN Zhiwen, JIANG Jianguo, ZHAO Weifeng, GAO Xingyu, LIU Yuan. Rule-based Data Fusion Model of Intrusion Detection[J]. , 2005, 31(16): 145-146.