混合型入侵检测系统的研究

Research on composite intrusion detection system

针对目前的入侵检测系统大多存在误报率高、检测效率低等问题,在研究混合型入侵检测理论的基础上,提出了混合型入侵检测系统的系统构架和功能结构设计,并详细介绍了几个关键模块的理论、设计和部分算法。其特点是在数据源上结合网络和关键主机数据,在检测方法上结合异常分析技术和误用分析技术并提出了二层混合分析方法,同时在系统体系构架上可灵活扩展以适用于不同的网络环境,提高了混合型入侵检测系统的检测能力和检测的准确性。

The main problems of some normal intrusion detection system＇ s high error report rate and low efficiency are the singularity of information sources and analysis methods. Based on the theory of composite intrusion detection, the system architecture and functional framework of composite intrusion detection is given, and the theory, design and some algorithms of several key modules are introduced in detail. A double-layer composite analysis method as its detection method is put forward, which combines data from the network and the key hosts as its source. It can apply to different network environment with flexible architecture and raise the safety and the stability of the network.