基于主被动结合的网络入侵检测系统的设计与实现

Design and Implementation of a Initiative and Passive Network Invasion Detection System

提出了一种新的基于主被动结合的网络入侵检测系统。详细论述了新的网络入侵检测系统的设计方案,关键技术的研究与实现。本系统所设计的关键技术模块有信息采集模块、蜜罐技术原理和部署模块以及黑板管理模块。该系统采用主动专家系统进行高效的入侵检测,结合蜜罐技术来收集网络中出现的各种攻击信息,运用人工智能的方法将这些攻击信息进行融合、训练,提取和更新攻击知识库,具有一定的自主学习功能和自适应性。

This paper presents a new design based on the combination of initiative and passive network invasion system. The new system includes three modules： information collection module, honeypot deploy module and blackboard management module. The system uses initiative expert system for efficient invasion detection, and integrates honeypot technology to extract and update the attack knowledge base. It possesses a certain autonomous learning and selfadaptation.