一种分布式入侵检测系统模型研究

The Research of the Distributed Intrusion Detection System Model

针对传统的入侵检测方法存在的局限性,分析了分布式入侵检测系统的优势,并在此基础上提出了一种新的分布式入侵检测系统的模型,并对其各个功能模块进行了设计。该系统模型兼具基于特征和基于异常行为的特点,采用主机配置和网络布置相互配合的方式,并能与防火墙联动进行入侵防范。

The paper made an analysis of advantages of the distributed intrusion detection system surrounding the limitations of the traditional intrusion detection methods and then put forward a new model of the distributed intrusion detection system and designed all the functional modules.The model combines the based features and aberrant behavior and can prevent intrusion interacting with firewall by means of cooperation between host configuration and net layout.