¹Institute of Computer, Nanjing University of Posts and Telecommunications, State Key Laboratory of Novel Software Technology, Nanjing, P.R. China
²Institute of Computer, Nanjing University of Posts and Telecommunications, Nanjing, P.R. China

---

Abstract—This paper presents a method to establish a rulebase based on multilayer intrusion detection. This rulebase contains two parts: the rulebase based on IP layer intrusion detection and the rulebase based on application layer intrusion detection. The former adopts a mixed quadratic network statistical model to test network traffic which has performances of dynamic principle and low False Positive Probability ( FPP) and low False Negative Probability ( FNP), and the rulebase is established using the twice-aggregation method. The latter is established by improved Snort. The simulation has proved that this intelligent rulebase can improve detection rate and ability to a large degree, and has low FPP and FNP.

Index Terms—Misuse detection, Anomaly detection, Intelligent rule-base.

[PDF]

Cite: Sun Zhixin, Jiao Lin, "Research of Intelligent Rule-base Based on Multilayer Intrusion Detection," Journal of Computers vol. 4, no. 6, pp. 453-460, 2009.