摘要
针对滥用类入侵检测技术存在的不足,提出了基于特征信息序列语法分析的入侵检测技术。将同类型多种入侵用统一的文法描述,有效地避免了检测分析中盲目试探匹配过程及由此而产生的低效率问题。该技术总体上属于滥用检测技术的范畴,由于采用了可扩展的文法创建技术,使其具备一定的异常检测能力,因而兼备滥用检测和异常检测两类技术的优点,不仅能识别已知的入侵或攻击,对新出现的入侵也能及时发现。
Aiming at shortcomings of the present technologies, this paper offers a new intrusion- detection technology which is based on sequence of characteristic information syntax analysis. Unified grammar description with a variety of types of invasion is effective way to avoid blind testing and matching process of the detection analysis and resulting inefficiencies. The present intrusion - detection technologies based on sequence of characteristic information syntax analysis could be described as a misuse of the checking technology. However, the discussed technology, using the expandable grammarcreated teehnique, is equiped with an ability of abnormity deteetion, so it overcomes the shortcomings of both misuse checking technology and abnormity detection one, not only can identify known invasion or attack on the emerging invasion also discovered in a timely manner.
出处
《现代电子技术》
2009年第13期89-92,99,共5页
Modern Electronics Technique
关键词
入侵检测
特征信息序列
语法分析
属性文法
intrusion detection
sequence of characteristic information
syntax analysis
attribute grammar