动态可扩展混合型入侵检测系统研究

Research on Dynamic Extensible Mixed Intrusion Detection System

随着信息技术和互联网的迅速发展,计算机网络与信息系统所面临的安全问题越来越严重。传统的安全技术大都属于静态机制,局限于防护环节,难以满足网络安全的需求。入侵检测技术作为动态安全模型P2DR中检测部分的主要技术手段,能主动对网络和网络上的主机行为进行有效识别和响应,从而检测外部入侵和内部误用,为网络提供安全保护。

With the rapid development of information technology and Internet, the security problem of computer network and information system have become more and more serious. Most conventional security techniques are static mechanism and are limited to Protection phase, which can't satisfy the increasing demand for network security. As a primary technique in detection part of P2DR model, Intrusion Detection System (IDS) can efficiently recognize and respond to the actions of the network and the hosts actively. Thus it can detect intrusion and misuse to provide a sufficient protection to network security. This thesis proposes a Mixed Intrusion Detection System (MIDS). MIDS combines data from the network and the key hosts as its source, constructing MIDS with dynamic extensible modules.