New approach to evaluate the capacity of signature-based intrusion detection systems - SUN Mei-feng1; GONG Jian1; YANG Wang1 (Tongxin xuebao)
For improving the accuracy of IDS evaluation,after the detection method of signature-based IDS was analyzed,pointed out that the current methods are not reasonable,and proposed the principle to evaluate the capability of IDS im-plementation and the capability of rule base respectively.The method to evaluate the capability of IDS implementation,which views the human knowledge as parameters,was introduced.The definition of metrics and how to calculate the value of metrics are mainly discussed.A prototype was implemented which shows that this new method can evaluate the real capacity better for a signature-based IDS.