Standard No.:	GB/T 20275-2013
English Name:	Information Security Technology - Technical Requirements and Testing and Evaluation Approaches for Network-based Intrusion Detection System
Chinese Name:	信息安全技术 网络入侵检测系统技术要求和测试评价方法
Chinese Classification:	L80    Data encryption
Professional Classification:	GB    National Standard
Source Content Issued by:	AQSIQ;SAC
Issued on:	2013-12-31
Implemented on:	2014-7-15
Status:	superseded
Superseded by:	GB/T 20275-2021 Information security technology—Technical requirements and testing and evaluation approaches for network-based intrusion detection system
Superseded on:	2022-5-1
Superseding:	GB/T 20275-2006 Information security technology - Techniques requirements and testing and evaluation approaches for intrusion detection system
Target Language:	English
File Format:	PDF
Word Count:	40000 words
Translation Price(USD):	140.0
Delivery:	via email in 1 business day

1 Scope This standard specifies technical requirements and testing and evaluation approaches for network-based intrusion detection system, including security function requirements, self-security functional requirements, security assurance requirements and testing and evaluation approaches and proposes grading requirements for network-based intrusion detection system. This standard is applicable to design, development, testing and evaluation of network-based intrusion detection system. 2 Normative References The following documents for the application of this document are essential. For dated reference, only the edition cited applies. For undated references, the latest edition of the normative document (including any amendments) applies. GB/T 18336.1-2008 Information Technology - Security Techniques - Evaluation Criteria For IT Security - Part 1: Introduction and General Model GB/T 25069-2010 Information Security Technology - Glossary 3 Terms and Definitions For the purposes of this document, the terms and definitions established in GB/T 18336.1-2008 and GB/T 25069-2010 and the following ones apply. 3.1 Event A record of occurrence or modification of system, service or network state, as a basis of security event analysis. 3.2 Incident Occurrence of a system, service or network state is identified by the analysis and process of event which indicates one possible breach of security rules or failure of some protective measures or indicates one case likely to be security-related but used not to be known, such case is very likely to harm the business operation and threat the information security. 3.3 Intrusion Any behavior which harms or possibly harms the resource integrity, confidentiality or availability. 3.4 Intrusion detection Find behaviors in breach of security policy and attack sign in the network or system by collecting and analyzing several key points in computer network or computer system. 3.5 Network-based intrusion detection system An intrusion detection system which takes the network data package as data source to monitor and analyze all the data packets within the protective networks and find the abnormal behavior. 3.6 Sensor A component of intrusion detection system which is used to collect real-time event likely to indicate the intrusion behavior or misuse information system resource and make a preliminary analysis on the information collected. 3.7 Alert Urgent notice which the network-based intrusion detection system sends to the authorized administrator in case of attacks or instrusion. 3.8 Response The behavior of protecting information system and stored data and restoring them to normal operation environment in case of attack or intrusion. 3.9 False positives The network-based intrusion detection system alarms when the attacks do not occur or sends false alarms. 3.10 False negative Network-based intrusion detection system fails to alarm in case of attack. 4 Abbreviated Terms For the purpose of this document, the following abbreviated terms apply. ARP: Address Resolution Protocol DNS Domain Name System FTP File Transfer Protocol HTML Hypertext Markup Language HTTP Hypertext Transfer Protocol ICMP Internet Control Message Protocol IMAP Internet Message Access Protocol IP Internet Protocol NFS Network File System POP3 Post Office Protocol 3 RIP Routing Information Protocol RPC Remote Procedure Call SMTP Simple Mail Transfer Protocol SNMP Simple Network Management Protocol TCP Transport Control Protocol TELNET Telecommunication Network TFTP Trivial File Transfer Protocol UDP User Datagram Protocol 5 Grading of Network-Based Intrusion Detection System

Foreword I 1 Scope 2 Normative References 3 Terms and Definitions 4 Abbreviated Terms 5 Grading of Network-Based Intrusion Detection System 5.1 Grading 5.2 Grade Table 6 Technical Requirements for Network-Based Intrusion Detection System 6.1 Grade 1 6.2 Grade 2 6.3 Grade 3 7 Testing and Evaluation Approaches for Network-Based Intrusion Detection System 7.1 Testing Environment 7.2 Testing Tool 7.3 Grade 1 7.4 Grade 2 7.5 Grade 3 Reference