IDMEF的XML数据存储和查询研究

Research on the Storage and Query of Base-XML Format IDMEF

越来越多的应用使用XML作为一种通用数据交换格式。IDS也使用XML来定义入侵警报信息规范-IDMEF(Intrusion Detection Message Exchange Format),[12]。IDMEF是一种结构比较简单的XML,如果使用通用XML的存储和查询技术,系统会变得比较复杂。分析IDMEF的DTD,发现使用栈结构来存储和查询是十分方便的。把DTD文件经过语法分析,转化成栈结构的数据,再把栈结构的数据保存到关系数据库中。在此基础上可以很容易地实现入侵警报信息的存取、检索。这种方案只需要使用两个表,描述简单、容易实现。很容易把这种方案推广到其他格式简单的XML的存储和查询中,具有一定的通用性。

As more and more information is exchanged in XML, IDS also uses XML to define IDMEF(Intrusion Detection Message Exchange Format)[1,2]. Because of the simplicity of the structure of IDMEF, general technology for the storage and query of IDMEF will incur more overheads, after analyzing the DTD of IDMEF, it is found to be convenient to store IDMEF by a stack. people may parse the DTD file to generate a stack, store this stack into relational DBMS, then can access or retrieve messages about intrusion alert. This strategy uses only two tables and is easy to be implemented. It is easy to apply this technique to other similar XML-format data. ;;;