A high-performance network intrusion detection system

摘要: In this paper we present a new approach for network intrusion detection based on concise specifications that characterize normal and abnormal packet sequences. Our specification language is geared robust by enforcing strict type discipline via combination of static dynamic checking. Unlike most previous approaches in detection, our can easily support protocols as information relating to the are not hard-coded into system. Instead, simply add suitable definitions define patterns these types. We compile high-performance Important components include efficient algorithms pattern-matching aggregation sequences packets. particular, techniques ensure matching time insensitive number characterizing different intrusions, operations typically take constant per packet. system participated an evaluation organized MIT Lincoln Labs, where demonstrated its effectiveness (96% rate low-level attacks) performance (real-time at 500Mbps), while producing very few false positives (0.05 0.1 attack).