Improving intrusion detection through merging heterogeneous IP data

Intrusion Detection is an important and classical research area in network security. It is observed that existing intrusion detection methods usually research all data in the network as a whole. However, in reality, data in the network can be categorized into two types: upward IP data and downward IP data. These two types of IP data may play different roles in intrusion detection process. Based on this observation, a novel intrusion detection method called Duplex Traffic Joint Analyzing(DTJA) method is proposed so as to consider both upward and downward IP data more specifically. With this method, intrusion clues can be found more effectively and efficiently. Experiment results indicate this method is feasible.