An Improved Snort Intrusion Detection System Based on Self-Similar Traffic Mode

This paper introduces the existing distributed intrusion detection technology and points out the disadvantages of the traditional intrusion detection system. A distributed intrusion detection system based on self-similar traffic is designed and the specific implementation of all parts is presented. In the analysis system, an anomaly detection engine is added before the misuse detection engine. The authors design an anomaly detection engine based on self-similar traffic model. Then we optimize the evaluation of hurst parameter and its value scope based-on time-domain analysis. These improvements can effectively detect unknown intrusion after filtering the normal network traffic.