Research of intrusion detection system based on vulnerability scanner

Feature matching is an important way of network intrusion detection system. With the increasing of attack types, rule database becomes more and more larger and the course of matching also becomes increasingly complex, which makes IDS easily to lose packets. For the problem above, two kinds of signature customization methods which based on open ports and CVE number are designed in this paper. These methods integrate the IDS and vulnerability scanner, help the misuse NIDS to select appropriate signature for the protected host and eliminate unnecessary signature matching through not modifying too much programs and setting the values of NIDS. Some experiments have been done on testing the integrated system. The results show that IDS can reduce the detection rules, useless alerts and improve detection efficiency after customization signature.