D-S Evidence Theory and its Data Fusion Application in Intrusion Detection

Based on the D-S Evidence Theory and its Data Fusion technology, a new Intrusion Detection Data Fusion Model-IDSDFM is presented. This model can merge alerts of different types of IDSs, make intelligent inference by applying the D-S Evidence Theory, and estimate the current security situation according to the fusion result. Then some IDSs in the network are dynamically adjusted to strengthen the detection of the data that relate to the attack attempt. Consequently, the false positive rate and the false negative rate are effectively reduced, and the detection efficiency of IDS is accordingly improved.