Measuring similarities among intrusion detection rules on the MapReduce environment

Abstract

In this paper, we define the problem of measuring similarities among intrusion detection rules written as regular expression. It is related to the efficiency of the intrusion detection systems. To avoid complex computation related to regular expression, we propose a simple heuristic of considering them as strings and computing the distances among them. We implemented this idea on MapReduce environment.