APPARATUS FOR MEASURING SIMILARITY BETWEEN INTRUSION DETECTION RULES AND METHOD THEREFOR

摘要

The present invention relates to an apparatus and method that check similarity between intrusion detection rules used by an Intrusion Detection System. The apparatus for measuring similarity between intrusion detection rules includes a normalization unit for modifying a plurality of detection rules in a predetermined form, a division unit for dividing each of detection rules among a plurality of modified detection rules into a detection rule header and a detection rule option, a relationship operation unit for determining an inclusion relationship between a detection rule headers, and determining an inclusion relationship between a detection rule options, and a similarity measurement unit for measuring similarity between the detection rules based on the inclusion relationship between the detection rule headers and the inclusion relationship between the detection rule options.