Two-step rule estimation (TRE) - intrusion detection method against eluding NIDS

In this paper, we propose a TRE (Two-step Rule Estimation) method that can avoid eluding attacks of NIDS (Network-based Intrusion Detection System). Many existing NIDS have used rule-based pattern-matching method, that is, an expert system. However, this method is very vulnerable to insertion and evasion attacks. The TRE method proposed in this paper consists of two processes; the first process involves a preprocessor that searches for the optimal rule similar to a captured packet, and the second process involves a main processor that achieves adaptive pattern matching. The TRE is designed to detect various kinds of eluding attacks and can decrease the miss-detection probability of the rule-based pattern matching that is usually used in NIDS.