Journals Proceedings

Abstract

IDS is a protective system which identifies the occurring violations on the network and its performance is based on different methods. The most common method of IDS performance relies on patter compatibility in which the ordinary behaviors are recognized so that the abnormal behaviors are identified and specific patterns are found for them. In this paper, through a proposed algorithm, we aim at presenting an improved algorithm from combination of two different algorithms of HC and QWM and clustering the data base of attack signature using decision tree for the operations of pattern compatibility in IDS. The benefit of using this method is that compatibility can be managed in such a way that the extra searches are prevented and the best result is obtained during the overlapping of known attacks with main pattern in high speed.