关键词: 入侵检测, 请求/应答协议, 传输控制协议, 有限状态机, 协议解析, 伪警报

Abstract: Concerning the enormous alerts produced by Intrusion Detection System (IDS), a method based on protocol parse and Transfer Control Protocol (TCP) Finite State Machine (FSM) model was proposed to remove the false alerts. To the alerts produced by connectionless request/response protocol, the method made judgement through the analysis of the attack features of the request packets and return status code of response packets; to the alerts produced by the TCP, the paper parsed the packets and built up TCP FSM model to make judgement whether the series packets came from the same TCP connection, whether the TCP connection included attack sequences to remove the false alerts. Lastly the experiments made on DARPA 2000 datasets show that the proposed method can reduce the false alert more than 59.47% on average, and the alerts recognition rate of the TCP and the request/response protocol reaches 76.67%. This method is simple and efficient which depends on the attack features database of IDS, and can be implemented on line by plug-in.

Key words: intrusion detection, request/response protocol, Transfer Control Protocol (TCP), Finite State Machine (FSM), protocol parse, false alert