基于风险管理的入侵检测数据采样策略模型

基于网络的入侵检测系统通过详细分析计算机网络中传输的网络数据包进行入侵检测,由于检测速率与数据包采集速率不匹配,以及检测所需成本的限制,在收集用于检测的网络数据包时必须选择有效的采样策略。引入了博弈模型框架上的原始入侵数据包采样策略,在此基础上再进行分析和扩展。同时,讨论了原有单一采样策略的不足,引入风险管理的思想并通过具体的实例来分析在不同风险情况下的策略选择问题。

Network packet sampling strategy model of intrusion detection based on risk management approach

Intrusion detection is an important part of the information security research,and the network-based intrusion detection system accomplishes the detection by examining network packets.Since sampling entails incurring network costs for real-time packet sampling and packet examination hardware,a network packet sampling strategy is developed to detect network intrusions effectively while not exceeding the velocity of the packet examination.This problem is considered in a game theoretic framework and a sampling scheme that is optimal in game theory setting by the Minimax theorem and the max-flow min-cut theorem is developed.The method of risk management is also introduced and the solution is extend to more complex cases to solve the choice of sampling strategy while facing more various environments.