The Study And Implement Of An Intrusion Detection System Based On Neural Network And Pattern Matching

The technology of the network security is being improved by the requirements of network safety continually. Although each kind of technology has its own strongpoint, but the performance of the detection is restricted by their natural shortcoming. The combination of the technology is the most effective way to improve the capability of the intrusion detection system.In this paper, the research condition as well as the future of the intrusion detection technology is mentioned firstly. Secondly, the property of the network intrusion is analyzed in detail. By the way that the feature exists, the network intrusion can be divided into two categories. The first kind of intrusion action feature is mainly represented by the duration of the connection and the feature of the network flow, and the second kind hide in the data segment of the IP packet, they are mainly the system calls that cause the intrusion action. Because the feature of this kind of intrusion is similar to the normal network flow, so analyzing the statistical information can't differentiate them. Then the character of neural network and pattern matching is analyzed, the neural network is fit to detect the intrusion based on the statistical feature of network flux, and the pattern matching detects the intrusion by searching specific character string in the data packet. So we bring forward to a system based on the technology of neural network and pattern matching. To improve the detecting capacity of the neural network, the features of connection time and network flux are as the new parts of network input besides the classical items. The system can works with two models, mutual and inbuilt model, which meet with the different requirement of the speed or detection precision and improve the performance and application scope of the system.The system can detect known intrusion and, in some cases, unknown intrusion at same time. Experiment testifies that the intrusion detect system combined the two technologies has more detecting capacity.