| 摘要 |
A method for determining suitable detection performance of an IDS and a recording medium thereof are provided to increase measurement accuracy of the detection performance by measuring the detection performance based on a ratio of real intrusion events among the intrusion events detected in the IDS. Whether the detected intrusion event is the real intrusion event is determined if the intrusion event is detected(S10). The number of intrusion events is increased if the detected intrusion event is the real intrusion event(S12). The number of non-intrusion events is increased if the detected intrusion event is not the real intrusion event(S14). Detection performance accuracy is calculated by the ratio between the number of real intrusion events and the number of non-real intrusion events if a test according to the intrusion detection is finished(S18). The detection performance of the IDS is determined based on the detection performance accuracy(S22). Profile information of the detected intrusion event is stored to a database storing intrusion patterns. The intrusion pattern of the intrusion event is stored to the database if the intrusion event has a characteristic different from the intrusion patterns stored in the database.
|
