Intrusion detection system rule matching optimization method based on machine learning

Abstract

The invention provides an intrusion detection system rule matching optimization method based on machine learning, and the method comprises the steps: continuously learning the historical alarm of an intrusion detection system through a machine learning period construction module, and periodically constructing a machine learning data training set; enabling the machine learning prediction module to perform real-time prediction on the selected pre-matching rule sequence after the network message enters the second detection engine stage, and outputting the hit probability of the pre-matching rule base sequence; and performing inverse sorting on the pre-matching rules according to the hit probabilities, so that the intrusion detection system preferentially traverses the pre-matching rule with the highest hit probability. The method can effectively reduce the number of invalid matching times of the intrusion detection system, improve the performance of the intrusion detection system, dynamically adjust the pre-matching rule sequence of the intrusion detection system, and ensure the stability of the efficiency of the intrusion detection system in different flow scenes. By regularly updating the machine learning data set, the stability of the intrusion detection system in a multi-flow scene can be effectively improved.

Description

technical field [0001] The invention relates to the field of robot systems, in particular to a machine learning-based intrusion detection system rule matching optimization method. Background technique [0002] An intrusion detection system ("IDS" for short) is a network security device that monitors network transmissions in real time, and sends an alarm or takes active response measures when suspicious transmissions are found. [0003] An intrusion detection system is a group of computer programs that realize intrusion detection through misuse detection (Misuse Detection), anomaly detection (Anormal Detection) or a combination of the two technologies. [0004] Anomaly Detection (Anomaly Detection) is a behavior-based intrusion detection system. It first summarizes the characteristics that normal operations should have. When user activities deviate significantly from normal behavior, it is considered an intrusion. [0005] Misuse Detection is an intrusion detection system ba...

AI Technical Summary

Problems solved by technology

[0014] (1) The rule base is huge, the intrusion detection system has many invalid matches, and the detection performance is low

[0015] (2) The performance of the intrusion detection system is unstable under different traffic scenarios

Images