基于程序追踪的程序关联模型的研究

The Research of Process Relationship Correlation Model Based on Process Tracing

文章针对入侵检测方式中的传统关联分析方法所存在的问题,利用程序追踪方法来补足关联分析所需的信息,并提出了一种新的关联分析模型——程序关联模型。该模型可以弥补传统分布式入侵检测系统难以检测的一些攻击手法,从而提高了IDS的入侵检测率。

This article aimed at the question of traditional Correlation analyse in Intrusion Detection, make up the information needed for correlation analysis to using process tracking, which proposed a new Correlation analysis model - PRCM.The model can make up for some of the methods of attack detection difficult in traditional DIDS,thereby increasing the Intrusion Detection rates of IDS.