This tool is aim to test the technology of evading ids by utilizing the weaken of network layer and the transmission layer . and then we test the snort by using the tester and the hacker tool , from the result we find a critical problem faced by a network intrusion detection system ( nids ) is that of ambiguity is the main reason that producing the make false positive and false negative 通过该工具与第三方黑客软件? fragroute相结合,对入侵检测系统软件- - snort进行测试,从结果的分析中得知网络入侵检测体系所面临的语义模糊性问题是造成漏报率和误报率很高的一个主要原因,入侵者就可能利用这一漏洞逃过nids的检测或者引起检测系统的误警。
For the main body of the intrusion is coming indirect , the scope of it larger , the techniques are distributing and the object is changing , the intrusion detection system must improve its response speed , data analyzing speed and reduce the miss rate and false alarm rate . this system uses both parallel reasoning and fuzzy reasoning techniques 由于目前入侵趋于主体对象的间接化、入侵或攻击的规模扩大、入侵或攻击技术的分布化、攻击对象转移，因此必须提高入侵检测系统的实时响应速度、数据处理速度、同时降低系统对漏洞的误报率和漏报率。
The results of process monitoring indicate that this method is more effective than the process monitoring method based on conventional blind source signal separation . 6 ) due to the complexity of process information , a process monitoring method which applies independent component analysis and principal component analysis to extract nonnormal distributed process features and normal distributed process features is presented , which avoids the assumption that process information is subjected to multivariate normal distribution 8 )鉴于在过程中，过程信息的平稳性并不确定，提出了一种不考虑过程平稳性能的过程监控方法，仿真表明该方法比基于传统ica的过程监控方法具有更少的误报率和漏报率，而比基于mspc的过程监控方法具有更少的误报率，从而说明该方法的有效性。
This kind of investigations have acquired some accomplishments at present , but much of these accomplishments were limited to resolve certain frondose application using certain fixed network model and were far from satisfying the minimizing forecasting faults demands of ids improving . the purpose of this theme is to establish a multi - net - model and make it generally applicable during the arithmetic realization process to content all application demands and thus minimize forecasting faults in the end of this article applying the advanced bp network to the es in ids minimized the false forecasting , further more it discussed the process of using visual c + + to realize these networks 目前，这方面的研究已有了部分成果，但大多只局限于应用一种固定的网络模型来解决某一具体的应用，还远远不能满足入侵检测漏报和误报率高的问题，本文的研究目的就是要建立一种灵活的网络模型，并在算法实现过程中使其具有通用性，以满足各种应用的需要，尤其是使入侵检测的漏报率和误报率趋于最小化。
The essence of edid is to set up a normal behavior fuzzy sub collection a on the basis of watching the normal system transfer of the privilege process , and set up a fuzzy sub collection b with real time transfer array , then detect with the principle of minimum distance in fuzzy discern method the innovation point of this paper is : put forward the method of edid , can not only reduce efficiently false positive rate and false negative rate , also make real time intrusion detection to become possibility ; have independent and complete character database , according to the classification of monitoring program , design normal behavior and anomaly behavior etc . , have raised the strongness of ids ; use tree type structure to preservation the character database , have saved greatly stock space ; in detection invade , carry out frequency prior principle , prior analysis and handling the behavior feature of high frequency in information table , have raised efficiency and the speed of detection , make real time intrusion detection to become possibility ; have at the same time realized anomaly intrusion detection and misuse intrusion detection , have remedied deficiency of unitary detection method 这种方法的实质是在监控特权进程的正常系统调用基础上建立正常行为模糊子集a ，用检测到的实时调用序列建立模糊子集b ，然后用模糊识别方法中的最小距离原则进行检测。本文的创新点是：通过对特权进程的系统调用及参数序列的研究，提出了基于euclidean距离的入侵检测方法edid ，不仅能有效降低漏报率和误报率，而且使实时入侵检测成为可能；设计有独立而完整的特征数据库，根据被监控程序的类别，分别设计正常行为、异常行为等，提高了检测系统的强健性和可伸缩性；特征数据库按树型结构存储，大大节省了存储空间；在检测入侵时，实行频度优先原则，优先分析和处理信息表中的高频度行为特征，提高检测的速度和效率，使实时入侵检测成为可能；同时实现了异常入侵检测和误用入侵检测，弥补了单一检测方法的不足。
Consequently , this system has low false alarm rate as well as low miss alarm rate . what ' s more , it has real - time data analyzing and responds on time . all these characters make this intrusion detection expert system have much more protecting capacity 本系统将模糊推理和并行推理相结合的推理技术用于对入侵特征的分析与辨识，构建起基于误用和基于异常相结合的入侵检测系统，使系统在保持以专家系统开发入侵检测系统误报率低的优势之外还降低了入侵检测的漏报率，而且数据分析更具实时性，响应及时有效。
In order to withstand more and more frequent compound network attacks and hacker commitment of distribution , multiobjective , multistage nowadays , improve intrusion detection efficiency under the circumstance of high band width and large - scale network , decrease false negative rate and shorten detection time , incorporating advanced machine learning techniques into ids is already a well - known thought 为了对付目前越来越频繁出现的分布式、多目标、多阶段的组合式网络攻击和黑客行为,提高在高带宽、大规模网络环境下入侵检测的效率、降低漏报率和缩短检测时间,把先进的机器学习方法引入到ids中来已成为一种共识。
