Abstract:
This paper considers the intrusion behavior, phases and effects with the detection rule to get the more efficient detection and response. By changing the general rule sentence like if then ,it expands the description for detection rule with CISL in CIDF frame. Some design requirements for A-Box and R-Box are also discussed.
摘要： 通过对传统检测规则中的 if <条件> then <动作> 的修改，将入侵行为、阶段特征、入侵的后果影响进行量化，并与检测规则相联系，以提高对入侵的检测效率和响应效率，同时在这基础上给出CISL的一个规则描述上的扩充，并讨论其对A-Box和R-Box的设计需求。
关键词:
入侵检测,
CIDF,
检测规则
CLC Number:
TANG Yi1,2，WU Xiaoming1. Detection Rule with Intrusion Profile and Its Application in CIDF[J]. , 2002, 28(10): 53-55.
唐屹,伍小明. 带状态特征的检测规则及其在CIDF框架中的应用[J]. , 2002, 28(10): 53-55.