Research of Intrusion Detection System Based on Vulnerability Scanner

摘要：

Feature matching is an important way of network intrusion detection system. With the increasing of attack types, rule database becomes more and more larger and the course of matching also becomes increasingly complex, which makes IDS easily to lose packets. For the problem above, two kinds of signature custonuzation methods which based on open ports and CVE number are designed in this paper. These methods integrate the IDS and vulnerability scanner, help the misuse NIDS to select appropriate signature for the protected host and eliminate unnecessary signature matching through not modifying too much programs and setting the values of NIDS. Some experiments have been done on testing the integrated system. The results show that IDS can reduce the detection rules, useless alerts and improve detection efficiency after customization signature.

关键词： NIDS vulnerability scanner signature cusiomization CVE

作者: Guangming Yang Jian Xu Dongming Chen Zhiliang Zhu

作者单位: Software College of Northeastern University Shenyang,China Software College of Northeastem University Shenyang,China

会议类型: 国际会议

会议名称: The 2nd IEEE International Conference on Advanced Computer Control(第二届先进计算机控制国际会议 ICACC 2010)

会议地点: 沈阳

会议语种:英文

页码: 173-176

在线出版日期: 2010-03-27（万方平台首次上网日期，不代表论文的发表时间）