可扩展的异常检测系统的研究与实现

Research and implementation of extensible anomaly-based detection systems

提出了可扩展的基于异常的入侵检测检测系统的体系结构,系统采用分布式结构及灵活的插件机制,可以方便地扩充检测功能,具有很好的可扩展性。实现了3种基于异常的检测算法,即相等匹配、数据挖掘、神经网络,为检测未知特征模式的攻击提供了较为有效的手段。

A novel framework, extensible anomaly-based detection systems （EAIDS） is described, for implementing several techniques for intrusion detection based on anomaly detection. The architecture of EAIDS is extensible because EAIDS utilizes a flexible modular plug-in architecture. Three anomaly detection algorithms, i.e., equality matching, data mining and artificial neural networks are introduced, which provides efficient methods for detecting unknown intrusion.