基于Snort的入侵检测系统规则泛化
Rule Generalisation in Intrusion Detection Systems using Snort
摘要：
入侵检测系统（IDS）为计算机系统和网络提供了重要的安全层，并且随着对因特网服务的依赖的增加以及具有敏感数据的系统更普遍地对因特网访问开放而变得越来越必要。IDS的职责是检测可疑或不可接受的系统和网络活动，并向系统管理员发出警报。大多数id使用一组签名来定义什么是可疑流量，而Snort是一种流行且正在积极开发的开源id，它使用这样一组称为Snort规则的签名。我们的目标是确定一种方法，可以通过概括规则来识别新的攻击，从而进一步开发Snort。特别是，我们试图放松和改变当前Snort规则的条件和参数，使用与经典规则学习算子（如泛化和专业化）类似的方法。我们通过标准数据集的实验证明了我们方法的有效性，并表明我们能够检测到各种攻击的先前未删除的变体。最后，我们讨论了一般的有效性和适当的概括在Snort的IDS规则处理。
英文摘要：
Intrusion Detection Systems (ids)provide an important layer of security for computer systems and networks, and are becoming more and more necessary as reliance on Internet services increases and systems with sensitive data are more commonly open to Internet access. An ids responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of ids use a set of signatures that define what suspicious traffic is, and Snort is one popular and actively developing open-source ids that uses such a set of signatures known as Snort rules. Our aim is to identify a way in which Snort could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current Snort rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard datasets and show that we are able to detect previously undeleted variants of various attacks. We conclude by discussing the general effectiveness and appropriateness of generalisation in Snort based ids rule processing.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
