A self-revised method of protocol identification using mutation test

Protocol identification is the key technology of intrusion detection. There´re much of traditional limitations exist in the process of character database development. This paper introduces the concept of mutation testing and designs several mutation operators for protocol identification based on Snort rules. A self-revised method is proposed and the efficiency of which is promoted. Experiment has shown that the method is effective in making automatic amendment against protocol rules within certain scope to improve the accuracy and efficiency.