基于公共入侵检测框架的组件通信机制研究

Study on Communication Mechanism of Common Intrusion Detection Framework

随着网络技术的迅速发展以及网络带宽的不断增大,网络安全问题也日益突出,入侵检测系统作为一种不同于防火墙的主动保护网络资源的网络安全系统,在实际生活中得到了广泛的应用。但随着计算机网络共享资源的进一步增强,入侵活动变得复杂而又难以捉摸,单一的、缺乏协作的入侵检测系统已经满足不了应用的需要,公共入侵检测模型则对入侵检测系统的组成架构、数据交换的格式、协作方法等进行了标准化。下文在论述公共入侵检测框架模型的基础上,详细阐述了如何使用轻型目录访问协议协议进行组件通信。

With the rapid development of the network technology and the increase of the network bandwidth,network security is becoming more and more important.As a different network technology to firewall,IDS becomes more and more popular.But with the more complicated intrusions and the more sharing resources,single IDS does not satisfy our needs.CIDF,introduced by this passage,standardizes the framework of IDS,the format and method of data exchange.IDSs corresponding to CIDF will work together better and become more secure and reliable.How to use LDAP to make components of CIDF communicate is also explained and analyzed.