摘要
误用检测是当前大多数入侵检测系统都采用的检测方法,它虽然对入侵的检测成效显著,但对一些潜在的入侵行为,无能为力。本文提出了一种新的入侵检测方案,它通过捕获动态的、潜在控制流和数据流,建立主体和对象之间的关系并进行分析,从而判断出潜在入侵行为。讨论了该方案的系统状态和状态转化规则,并通过一个实例证实了它在网络检测中的有效性。
At present, misuse detection is a current method of intrusion detection. Despite of excellent effect on intrusions, it holds futile on latent intrusion. This paper provides a new scheme for intrusion detection. Through tracing the data stream and control flow in the safety system, the scheme can establish the relationship of subject and object. According to the analysis of the relationship, it may recognize latent intrusions. The article introduces the system states and state transition of the scheme. In the end, we evaluate the model by an implemental case.
出处
《咸阳师范学院学报》
2008年第2期59-61,共3页
Journal of Xianyang Normal University
基金
咸阳师范学院基金项目(06XSYK282)
关键词
入侵检测
误用检测
状态转换
intrusion detegtion
misuse detection
state transition
