Intrusion Detection Systems (IDSs) are essential for identifying and mitigating cyber threats in modern network infrastructures. Although prior work has extensively explored the optimal placement of IDS sensors across networks, optimizing the deployment of detection rules across multiple IDS instances remains a mostly underexplored area. This paper addresses rule deployment by formulating it as a set covering problem with capacity constraints. We seek to minimize the number of rule deployments required to detect potential exploits of all known vulnerabilities while ensuring that no IDS exceeds its inspection capacity. Our model considers the statistical properties of network traffic, enabling the system to account for load surges and reduce the number of packets not inspected by an IDS under high-traffic conditions, such as during Distributed Denial-of-Service attacks. To solve the optimization problem, we introduce a backtracking algorithm enhanced with a priority queue, which efficiently balances rule coverage and capacity constraints. We validate our approach using the CSE-CIC-IDS2017 dataset and a simulated multi-IDS environment. Experimental results demonstrate that our method significantly reduces the number of uninspected packets, while maximizing vulnerability coverage, and outperforms typical rule deployment strategies. This work highlights the critical role of intelligent rule placement in enhancing IDS performance and paves the way for future adaptive and scalable detection systems.
扫码关注我们
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号