LRK Patent Law Firm
Apparatus and method for improving detection performance of intrusion detection system
An apparatus for improving detection performance of an intrusion detection system includes a transformed detected data generation unit for changing original detected data, detected based on current detection rules, to transformed detected data complying with transformed detected data standard. A transformed detected data classification unit classifies the transformed detected data by attack type, classifies transformed detected data for attack types by current detection rule, and classifies transformed detected data for detection rules into true positives/false positives. A transformed keyword tree generation unit generates a true positive transformed keyword tree and a false positive transformed keyword tree. A true positive path identification unit generates a true positive node, and identifies a true positive path connecting a base node to the true positive node in the true positive transformed keyword tree. A true positive detection pattern generation unit generates a true positive detection pattern based on the true positive path.
ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE
H G
H04L G06F
inventional inventional
KyuCheol TaekKyu Soonjwa Geunyong NamHoon Seokwon Hyung Geun Ki Wook
Jung Lee Hong Kim Lee Lee Oh Sohn