异常入侵检测系统虚警率问题研究

摘要

False positive rate of intrusion detection systems (IDS) affect the detection creditability.Methods to reduce the false positive rate were presented after analyzing creditability of IDS and false positive rate of anomaly IDS.It put methods include the followings:method based on process detection, multi-detection system model.It put emphasis on constructing normal profile dynamically based on artificial immunity to restrain false positive rate, then simulation ex-periment was done.The results show that the method can improve the detection efficiency and reduce the false positive rate.%入侵检测系统的虚警率影响检测结果的可信性.通过分析入侵检测系统的可信问题及异常入侵检测系统的虚警率问题,提出了降低虚警率的方法:基于进程检测行为的入侵检测方法、多检测系统协作工作模式.重点描述了基于人工免疫思想,动态构建正常系统轮廓,抑制虚警率的方法,并对其进行了仿真实验.实验表明,本方法可以提高检测效率,有效降低系统虚警率.