主机日志分析及其在入侵检测中的应用

Analysis of Host Audit Trails and Their Applications to Intrusion Detection

主机日志在入侵检测中有着不可替代的作用,通过深入分析主机日志可以发现系统的异常行为。该文分析了主机日志的构成,主机日志在计算机安全领域中的应用,并给出了常用的主机日志和基于主机日志的入侵检测系统。主机日志的分析方法有很多,文章对这些方法进行了分类并对它们进行了详细的讨论。最后,给出了一种基于主机日志分析的入侵检测通用模型。

Host audit trails are very valuable in the fi el ds of Intrusion Detection.From their analysis you can identify host abnormality .This paper describes host audit trails,their uses and applications of their a nalysis to intrusion detection.There exists many methods for analysis of host a udit trails,these methods are classified and discussed in this paper.Finally, a general model is presented and result of its employment has proved that it is very valuable for intrusion detection analysis.