...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Procedia Computer Science >Dynamically Detecting Security Threats and Updating a Signature-Based Intrusion Detection System’s Database
【24h】

Dynamically Detecting Security Threats and Updating a Signature-Based Intrusion Detection System’s Database

机译：动态检测安全威胁并更新基于签名的入侵检测系统的数据库

获取原文
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The electronic attacks that threaten the security of networks and information are increasing, especially during the current rapid electronic revolution. Therefore, it is necessary to use surveillance and protection systems in order to secure computer networks. An intrusion detection system (IDS) is one of the most important security systems available on the market. An IDS is a system that can be used to observe network traffic for illegal activities or illegitimate access to the network and to display alerts in such cases. There are three main types of IDSs: signature-based IDSs, anomaly-based IDSs and a hybrid of both. Auto-updating lists of attacks in order to overcome new types of attacks is one of the main challenges for a signature-based IDS. Most IDSs update their databases manually—done by network administrators—or by using websites that offer newly detected attack signatures. This paper proposes a model of auto-updating the attack lists using a filtering engine that acts as a second IDS engine. The results show an improvement in the overall accuracy of the IDS using the proposed model. In addition to detecting new attack signatures based on similarity, a blacklist of IP factors is used in the proposed model, which automates the updating process of IDS databases with the new attack signatures without human interference.
机译：威胁网络和信息安全的电子攻击正在增加，特别是在当前快速的电子革命期间。因此，有必要使用监视和保护系统以保护计算机网络。入侵检测系统（IDS）是市场上最重要的安全系统之一。 IDS是一种系统，可用于观察网络流量中的非法活动或对网络的非法访问，并在这种情况下显示警报。 IDS分为三种主要类型：基于签名的IDS，基于异常的IDS以及两者的混合。自动更新攻击列表以克服新型攻击是基于签名的IDS的主要挑战之一。大多数IDS由网络管理员手动更新数据库，或使用提供新检测到的攻击特征的网站进行更新。本文提出了一种使用充当第二个IDS引擎的过滤引擎来自动更新攻击列表的模型。结果表明，使用所提出的模型可以提高IDS的整体准确性。除了基于相似度检测新的攻击特征外，在该模型中还使用了IP因子黑名单，该功能可以自动使用新的攻击特征对IDS数据库进行更新，而无需人工干预。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号