基于特征信息序列语法分析的入侵检测技术

Research on Intrusion Detection Based on Sequence of Characteristic Information

针对滥用类入侵检测技术存在的不足,提出了基于特征信息序列语法分析的入侵检测技术。将同类型多种入侵用统一的文法描述,有效地避免了检测分析中盲目试探匹配过程及由此而产生的低效率问题。该技术总体上属于滥用检测技术的范畴,由于采用了可扩展的文法创建技术,使其具备一定的异常检测能力,因而兼备滥用检测和异常检测两类技术的优点,不仅能识别已知的入侵或攻击,对新出现的入侵也能及时发现。

Aiming at shortcomings of the present technologies, this paper offers a new intrusion- detection technology which is based on sequence of characteristic information syntax analysis. Unified grammar description with a variety of types of invasion is effective way to avoid blind testing and matching process of the detection analysis and resulting inefficiencies. The present intrusion - detection technologies based on sequence of characteristic information syntax analysis could be described as a misuse of the checking technology. However, the discussed technology, using the expandable grammarcreated teehnique, is equiped with an ability of abnormity deteetion, so it overcomes the shortcomings of both misuse checking technology and abnormity detection one, not only can identify known invasion or attack on the emerging invasion also discovered in a timely manner.