入侵检测规则的冲突发现和解决1DetectingConflictforNetwork.PDFVIP

入侵检测规则的冲突发现和解决1 孙美凤①，② 龚俭① ①东南大学计算机系网络中心 南京 210096 ②扬州大学信息工程学院计算机系 扬州 摘要：IDS 中当前输入事件同时匹配入侵规则库中多条规则的现象称为检测冲突，它导致漏报和误报，降 低检测的精度。随着规则库规模的增大，冲突的可能性不断增加，也使得人工避免冲突的工作变得越来越 困难，因此冲突的自动检测是入侵规则库管理和维护的重要问题。本文首次提出入侵检测规则的冲突问题， 形式定义了冲突的检测标准，并给出冲突检测和解决的算法。对 Snort 规则库分析的结果表明了本文方法 的必要性和有效性。 关键字： 冲突检测；入侵规则；入侵检测系统；报文分类 中国图分类号：TP393 Detecting Conflict for Network Intrusion Rule Sun Meifeng Gong Jian Department of Computer Science and Technology Southeast University Nanjing 210096, P.R. China {msun, j gong}@nj Abstract The fact that input event matches more than one rule of intrusion rule base in IDS is considered as conflict, conflict potentially creates false positive and false negative, and moreover reduces detection efficiency. As the number of intrusion rules increases, the possibility of conflict will increase, and the manual work to avoid conflict will be difficult. So automatically detecting and resolving conflict is an important aspect in rule management and maintenance. This paper studies the conflict detection problem of intrusion detection rules, defines formally a set of principles to determine the relationship of two intrusion rules, then proposes algorithms to detect and resolve conflict. The analysis of snort rule base implies the necessity and the effectivity of the method presented in this paper. Keyword intrusion detection system; intrusion rule; conflict detection; conflict resolution 1 引言 基于攻击特征进行入侵行为识别的滥用入侵检测系统（IDS）包括两个关键部分：规则 库和检测算法。入侵规则编码了入侵过程的知识以及响应行为，检测算法依据入侵规则在输 入事件流中寻找恶意行为的证据并做出结论。显然,正确的入侵规则是做出正确检测结论的 前提。 目前入侵规则库的构造是渐进的和经验主义的，通常是入侵规则的简单罗列，语义矛盾 和重复不可避免的存在，从而导致了同 报 同时匹配两条或多条入侵规则的冲突现象的出 现。由于实时