入侵检测数据的获取和整理探讨

DATA OBTAINING AND CLEANING UP FOR INTRUSION DETECTION

本文讨论入侵检测数据的获取途径、方法、工具及获取数据的清理、规格化和数据转移至数据库的方法。基于网络的数据获取有网络端口数据包获取和分布式网络数据的获取。基于主机的数据获取有系统日志、注册表信息、活动目录信息等。所用工具包括Windows2003命令行工具、Wmic、C#、SQL Server和自由软件Ethereal等。

The way, method, tool of data obtaining, cleaning, standardization and shifting to database for intrusion detection are discussed. Network data obtaining includes obtaining data from network port and from distributed network system. There are several ways of obtaining data based on host computer, such as obtaining systematic daily record, information of the registration table, activity directory information, etc. Command Line in Windows 2003 Server, WMIC, C#, SQL Server and free software Ethereal are used.