利用高精度时间戳提高入侵检测率

Improving Intrusion Detection Rate Using High Precision Time Stamps

入侵检测系统(IDS)是重要的信息安全措施,如何提高检测率是目前入侵检测系统研究的热点。文章从入侵事件时间戳的角度,对提高检测率进行了讨论。首先论述了计算机系统获取高精度时间戳的方法,然后分析了入侵检测系统对日志、注册表、网络包事件的时间戳精度要求。最后,以注册表访问事件为例进行了仿真,实验证明这种高精度时间戳能有效识别事件顺序,在一定程度上提高了入侵检测系统的检测率。

Intrusion Detection System （IDS） is one of important devices for information security. In this field, how to improve intrusion detection rate is a keystone issue. How to get higher intrusion detection rate on the view of Time Stamps in intrusion events was discussed. Firstly, some methods were addressed to seize high precision Time Stamps. Secondly, the precision requirement of Time Stamps was analyzed in detail on the log, registry events and network packets. Finally, the registry events were simulated and the experiment results were construed, which could identify events sequence effectively and intrusion detection rate to a certain extent was elevated.