网络异常的主动检测与特征分析

Active Detection and Feature Analysis About Network Anomaly

目前入侵检测系统主要使用的技术还是特征检测,它只能检测已知的入侵,而异常检测尽管能检测未知入侵,却无法保证准确性和可靠性。特征检测是建立在对特征的准确定位基础之上的,而异常检测是基于不可靠行为的,只能描述某种行为的趋势。文中对基于异常和特征的入侵检测系统模型做了一定研究,把网络异常特征与异常检测技术结合,提高了入侵检测系统的检测效果。

Currently the main technology of intrusion detection system is feature detection, which can only detect the known intrusion, and anomaly detection can be used to detect the unknown intrusion, it is unable to ensure its accuracy and reliability. While anomaly detection is based on uncertain behavior, which can only describe the trend of behavior, feature detection is based on accurate feature locating. In this paper proposed a method which incorporate anomaly detection and feature detection to gain better performance, and also discussed the intrusion detection system model based on feature detection and anomaly detection.