IDS rule optimization system and optimization method

Abstract

The invention discloses an IDS rule optimization system and optimization method. The optimization system comprises an alarm log processing module which collects IDS alarm logs, generates unique identification codes and obtains a date of that day, a historical alarm database which stores historical IDS alarm logs, a query module which queries whether the collected IDS alarm logs are stored in the historical alarm database or not and performs storage if the collected IDS alarm logs are not stored in the historical alarm database, a rule statistics module which performs statistics on the historical alarm database of the past M days and generates M historical alarm lists, a scanning module which scans each historical alarm list and performs a query, an extraction module which extracts historical alarm logs, of which a statistic frequency is higher than a first threshold, and obtains an IDS rule name, an address statistics module which performs statistics on an address quantity according to a flow direction, a false alarm rule identification module which identifies an IDS rule, in which the address quantity subjected to the statistics is greater than a second threshold, as a false alarm rule, and a processing module which deletes the false alarm rule. According to the system and the method, the alarm quantity is reduced, so that the alarm accuracy is improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an optimization system and an optimization method of IDS rules. Background technique [0002] With the development of the Internet, more and more attention has been paid to network security. IDS (Intrusion Detection Systems, intrusion detection system) is a system widely used by enterprises. To ensure the security of the network system. However, there are a large number of false alarms in the IDS system itself, resulting in a large number of alarms. Security engineers cannot obtain real threats from the massive alarm information, which greatly reduces the availability of the IDS system. Contents of the invention [0003] The technical problem to be solved by the present invention is to provide an optimization system and an optimization method for IDS rules in order to overcome the defect that there are a large number of false alarms in the IDS itself in the prior art,...

AI Technical Summary

Problems solved by technology

[0003] The technical problem to be solved by the present invention is to provide an optimization system and optimization method for IDS rules in order to overcome the defect that there are a large number of false alarms in IDS itself in the prior art, resulting in a large number of alarms

Images