Packet Sampling Applications in campus High-speed network Intrusion Detection System

摘要

A technique of high-speed network intrusion detection system based on packet sampling theory is proposed. Starting with basic principles of packet sampling, this paper first analyses the significant mathematical conclusion of sampling strategies, then after discussing current strategies, mechanism and performance of different packet sampling methods, we specify an efficient strategy of packet sampling. Results show that this method can attain above 55% accurate rate with below 1% false rate in 94 specified attacking cases from DARPA 2000 IDS evaluation dataset.