ijsc_redraft_final International Journal of Semantic Computing c © World Scientific Publishing Company MEASURING INCONSISTENCY IN A NETWORK INTRUSION DETECTION RULE SET BASED ON SNORT∗

In this preliminary study, we investigate how inconsistency in a network intrusion de-tection rule set can be measured. To achieve this, we first examine the structure of these rules which are based on Snort and incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correla-tions among rules more explicit. We measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the informativeness of these measures. Finally, we propose a new measure of inconsistency for prioritized knowledge which in-corporates the normalized number of the atoms in a language involved in inconsistency ∗This is a revised and significantly extended version of [1]