EMERALD:一种基于事件监控的异常检测技术

EMERALD:Anomaly Detection Based Event Monitoring

EMERALD是一个检测跨越大型网络的恶意行为的分布式工具。它是一种高度分布的网络监控、能隔离攻击和自动反应的入侵检测系统。EMERALD采用了签名分析和静态轮廓两种方法对事件进行监控,对整个网络具有全局监测和反应能力。

The EMERALD(Event Monitoring Enabling Response to Anomalous Live Disturbances)aims at a large scale net.It uses highly distributed,surveillance and response monitors to detect anomalous disturbances.Signature analysis and statistical profiling are combined in event monitoring to provide localized real-time protection of the most services on the Internet.