Kernel-level intrusion detection method using simplification and grouping

Abstract

This paper proposes the kernel-level intrusion detection method (KIDM) using simplification and grouping of intrusion detection rules. These rules group into group-rule and common-rule generated by simplification. The intrusion detection is separated into common detection and extended detection step. The packet is checked by common detection using the common-rule. If this step detects nothing, the packet is forwarded to its destination. If not, it is passed into the extended detection using the group-rule. Through grouping of similar detection rules, the search space and searching time can be greatly minimized. Using the simplified rule in intrusion detection, the packet inspection time can be largely reduced. With the help of these two steps, fast and effective intrusion detection is possible in network nodes such as router and switch