入侵检测技术的初步探究

An Elementary Research For Intrusion Detection System

入侵检测系统是现代网络安全的重要组成部分。入侵检测就是通过监视特定的计算机或网络,检测可能的攻击。主要有两类入侵检测系统:基于主机的和基于网络的。前者监视整个网络或部分网段,后者监视特定的计算机。如将两类系统相结合,实时监控网络传输和系统事件,并对可疑的行为进行自动的安全响应,将最大程度地降低安全风险,保护网络的系统安全。

An Intrusion Detection Systems is an important part of modern network security. Intrusion detection is the monitoring of a computer network with the goal of detecting an attack. There are two major types of IDSs Host and Network-based. Network-based IDSs monitor the whole network or a segment of the network while host-based systems monitor a partic- ular computer. If an IDS is to be installed it must be deployed with the network type and topology in mind. IDSs do this well but must be used in conjunction with two intrusion detection systems.