一种基于审计的入侵检测模型及其实现机制

A New Audit-Based Intrusion Detection Model and Its Implement Mechanism

文中对基于系统调用序列的入侵检测进行了深入的研究 ,提出了一种新的基于审计事件向量的入侵检测模型 (AUDIDS) .这一模型除了具有系统调用序列入侵检测模型的优点外 ,比之已有的模型具有更丰富的语义及更高的效率 .针对此模型 ,文中还给出了此模型在linux上的实现机制 ,实现了审计事件的定义、收集和存储 ,并对正常库的存储及匹配方法进行了改进 .

Intrusion detection models based on system call sequence are discussed,and a new intrusion detection model based on audit event vector which is named 'AUDIDS' is presented.This model has not only the merits of the previous IDS model but also richer semantics and higher efficiency.We describe its implementation mechanism on Linux which defines,collects and stores audit event and improves the storage and matching of normal database.