Anti-intrusion detection system based on Snort engine and adopting logistic regression algorithm

Abstract

The invention discloses an anti-intrusion detection system based on a Snort engine and adopting a logistic regression algorithm. The anti-intrusion detection system comprises a preprocessing module, a detection module, an alarm module, a rule generation module and a rule base, the preprocessing module preprocesses the data packet and sends a preprocessing result to the detection module; the detection module identifies and distinguishes the preprocessing result, and sends the abnormal data packet marked with the feature tag to a rule base for matching judgment; the rule base performs matching judgment on the abnormal data packets marked with the feature tags, sends a matching judgment result to an alarm module, and sends the abnormal data packets which are not successfully matched and marked with the feature tags to a rule generation module; the alarm module gives an alarm according to a matching judgment result; and the rule generation module extracts and converts the abnormal data packets which are not successfully matched and marked with the feature tags to generate new rules, and stores the new rules in a rule base, so that the risk of network intrusion is reduced, and the security of network protection is improved.

Description

technical field [0001] The invention relates to the technical field of intelligent monitoring of power systems, in particular to an anti-intrusion detection system based on a Snort engine and adopting a logic regression algorithm. Background technique [0002] With the rapid development of the Internet, network information technology has been integrated into all aspects of people's lives. While improving people's quality of life, these technologies have also brought the threat of network attacks. Intrusion detection is a protection technology that ensures system security through security monitoring. By collecting equipment and network-related information in the system, and analyzing and identifying these data information, it is possible to determine whether there are abnormal behaviors in the system. Therefore, as an active information security protection technology, intrusion detection technology can effectively make up for the shortcomings of traditional security protectio...

AI Technical Summary

Problems solved by technology

The key point of detection efficiency is that the system can detect all data in the network in a timely manner, and the Snort intrusion detection system is extremely unfavorable to the security of the network environment due to the insufficient risk of detecting network intrusions.

Images