摘要
網路世界的到來帶給人們是前所未有的便利。然而隨著網路上不法的攻擊行為不斷的更新，使得這個網路世界亦受到相對的威脅。所以如何有效對於這些新型的攻擊進行防禦，是一個重要的議題。然而對於入侵偵測系統而言，雖然異常偵測的方式可以發現新的攻擊，但所發出的警報對於日後攻擊事件的追蹤，卻無太大的幫助。且因高誤判率的因素，故對於管理者而言，無法提供一個好的警報訊息可以進一步來使用。 本論文運用異常偵測及誤用偵測(anomaly-misuse)所混合的分析方法。以svm為異常偵測的模組，snort-rule為誤用偵測的模組所組合出來的架構。將原本異常偵測的警報再由snort-rule來確認是否為已知的攻擊行為，可以將原本繁多無意義的訊息，篩選出可能的潛在新攻擊事情的發生，並可利用這個方式來調整個別模組的不足。
並列摘要
The wide adoption of network technology has greatly facilitated modern life and activities. However, such networked world is also getting jeopardized due to the newer and newer patterns of threatening misuse or attack with the underlying technology. Therefore, it has been an important issue about how to effectively shell the network system against these new patterns of attack. Regarding the mechanism for detecting potential intrusion of the system, though new attack patterns can be discovered via anomaly detections, such detection reports are not very useful for further tracing potential of attacks. Besides, the high false alarm rate also creates problems for network managers to make good use of reported alarm messages. In this thesis , the techniques of anomaly-misuse analysis is adopted to develop a new framework of intrusion detection analysis.The proposed framework is based on the combined application of an anomaly detection module implemented with SVM and a misuse detection module using the rule-based Snort module. Therefore, this framework allows the detection system to filter out the tremendous amount of irrelevant alarm messages generated from the anomaly detection module by further confirming them with the misuse detection modules. Thus, this framework helps to improve the rate of attack detection by strengthening the system with modules of different purposes.