摘要
通过充分利用入侵检测各类产品的安全防护特点,本文设计了一种策略分流的入侵防御及恢复系统架构.采用双NIDS系统作为前端检测模块,通过策略分流,使得双NIDS系统全面覆盖入侵检测的各个协议层,充分发挥两种NIDS系统的检测优势,实现高效的入侵检测.并结合HIDS的主机日志防护机制及关键内容恢复机制,在即便出现入侵破坏数据的情况下,仍可保证系统的关键部位安全.
By making full use of the security features of intrusion detection products, this paper designs an intrusion prevention and recovery system architecture based on policy shunt. The system uses the double NIDS system as the front-end detection module, making the double NIDS system completely cover the various protocol layers of intrusion detection by policy shunt and gives full play to the advantages of both NIDS detection system to achieve the high-efficiency intrusion detection. In addition, the system combines with the host logs protection mechanisms and the key recovery mechanisms. Therefore, even in the case of intrusion and data destruction, the system can ensure the security of the critical parts in the system.
作者
杨忠明
秦勇
蔡昭权
YANG Zhong-Ming QIN Yong CAI Zhao-Quan(College of Computer Engineering Technical, Guangdong Institute of Science and Technology, Zhuhai 519090, China College of Computer Science, Dongguan University of Technology, Dongguan 523808, China Research Department, Huizhou University, Huizhou 516007, China)
出处
《计算机系统应用》
2017年第2期83-87,共5页
Computer Systems & Applications
基金
国家自然科学基金项目(61170193)
广东省工业高新技术领域科技计划项目(2013B010401036)
广东省高等学校优秀青年教师培养计划项目(YQ2014187)
广东省自然科学基金项目(s2013010013432)
广东省教育厅科技创新项目(2013KJCX0178)
