基于网络状态的入侵检测模型

A Network-State-Based Intrusion Detection Model

本文提出了一种基于网络状态的入侵检测模型。该模型结合网络入侵的目标和特点 ,利用有穷自动机理论 ,基于网络协议来实现进程和操作系统的状态建立 ,从而可以发现未知的入侵。本文论证了应用该模型的可行性 ,并利用通用入侵检测框架CIDF对应用该模型的入侵检测系统进行了描述 ,最后与其它入侵检测模型进行了比较。

First this paper presents a network-state-based intrusion detection model.This model is established by using DFA theory,the characters and the goals of net-attacks and fully depending on the states of the processes of net protocols and operation system so that it can discover unknown attacks.This paper proves that the model is feasible for intrusion detection and describes the IDS that uses this model to describe net-attacks by CIDF(Common Intrusion Detection Framework).In the end,the paper compares the model with other intrusion detection descriptions.