随着网络入侵检测系统的广泛使用,作为系统核心部件的网络攻击特征库对网络入侵检测系统性能的影响越来越大。论文根据网络攻击特征库的特点对其进行了优化设计,将网络攻击特征库分解为入侵行为特征描述库和入侵确认库两个核心库,通过实验证明该设计方案可显著提高网络入侵检测系统的性能。 With the widespread use of network intrusion detection system, the network attack signature database that is the core component of the system has more and more influence on the performance of network intrusion detection system. Based on the characteristics of the network attack signature database, the paper designs the network attack signature database by decomposing the network attack signature database into two core libraries of intrusion behavior description database and intrusion recognition database. The experiment proves that this design scheme can significantly improve the network intrusion detection system performance.