| With the continuous development of Internet technology, network security issues have become increasingly prominent. As a key technology in network security system, intrusion detection system is facing a tough challenge: how to analyze massive data processing in a timely manner, respond to the increasing prevalence of large-scale coordinated attacks, reduce false positives and false negatives, increase the efficiency of intrusion detection, and so on. While the researchers have made continuous efforts in these areas, there are many problems to be solved.A novel honesty-rate measurement based approach is proposed to improve the security and trust of intrusion detection systems. All the cooperative nodes join the system with an initial honesty rate. The honesty rate of a node dynamically increases or decreases depending on its status and behavior. The proposed approach compares the honesty rate of each node to eliminate or reduce the impact of harmful information from the malicious nodes, and then reduces the false positives and false negatives of the intrusion systems. The experiments and analyses of a representative case confirm the ability of the proposed approach to improve detection accuracy and detection capability.After the research on all the available intrusion detection system architectures, we design and implement the intrusion detection system based on the honesty-rate measurement mechanism. The entire system consists of child nodes such as host intrusion detection systems, network intrusion detection systems and network devices, all of which with independent detection function. Each child node in collaborate system collects the data such as host log data, network traffic data and device log data. All the data collected are unified in the consolidated log format and sent to the master server for the collaborative detection for the complex and subtle intrusion such as cooperative scans that can't be detected by a single child node. Each child node which joines the collaborative system based on the honesty-rate measurement mechanism filters the information from the malicious nodes with low honesty rate to improve the accuracy of the detection. Through experimental analysis, intrusion detection system based on honesty-rate measurement mechanism in this paper can effectively enhance the system detection capability. |
