摘要
针对目前的入侵检测系统大多存在误报率高、检测效率低等问题,在研究混合型入侵检测理论的基础上,提出了混合型入侵检测系统的系统构架和功能结构设计,并详细介绍了几个关键模块的理论、设计和部分算法。其特点是在数据源上结合网络和关键主机数据,在检测方法上结合异常分析技术和误用分析技术并提出了二层混合分析方法,同时在系统体系构架上可灵活扩展以适用于不同的网络环境,提高了混合型入侵检测系统的检测能力和检测的准确性。
The main problems of some normal intrusion detection system' s high error report rate and low efficiency are the singularity of information sources and analysis methods. Based on the theory of composite intrusion detection, the system architecture and functional framework of composite intrusion detection is given, and the theory, design and some algorithms of several key modules are introduced in detail. A double-layer composite analysis method as its detection method is put forward, which combines data from the network and the key hosts as its source. It can apply to different network environment with flexible architecture and raise the safety and the stability of the network.
出处
《计算机工程与设计》
CSCD
北大核心
2009年第3期547-551,共5页
Computer Engineering and Design
关键词
网络安全
入侵检测
入侵检测系统
误用检测
异常分析
误用分析
信息融合
确定性理论
network security
intrusion detection
intrusion detection system
misuse detection
anomaly detection
misuse detection
information fusion
theory of confirmation