基于RBR和CBR的网络入侵检测系统模型

摘要

针对传统RBR方法在检测网络入侵时存在的误报和漏报问题，文章提出了一种基于RBR和CBR技术相结合的网络入侵检测系统模型，该模型首先可对攻击行为进行规则识别，对于不能判断的数据包，转化成案例形式通过案例推理进行入侵检测。实验研究表明，该模型可大大提高入侵检测的精度和对未知攻击的检测能力，比传统使用单一规则推理的入侵检测模型具有更高的准确率，更适合目前高速网络环境下的入侵检测要求。%Aimed at the false alarms and high detection failures brought by traditional RBR nethod in detecting the network intrusion,this paper purposes a novel intrusion detection model based on RBR and CBR.The model ifrst identify aggressive behavior by rules,then turn the unknown data packets into the form of case for intrusion detection. Empirical studies have shown that the model is more accurate than traditional intrusion detection model based on RBR and more suitable for high-speed network intrusion detection requirements.