具有认知能力的入侵检测系统模型

A Model of Intrusion Detection System with Apperception Ability

介绍了入侵检测的原理 ,对目前入侵检测的模型和方法进行分析 ,并给出了一个具有认知能力的入侵检测系统模型。该模型由基于规则的检测模块、神经网络组件、统计分析处理模块三个主要模块组成。模型采用了异常检测和误用检测相结合的方法 ,使系统既有对已知的攻击有较好的识别能力 ,又有检测未知攻击的能力。文末指出了当前入侵检测存在的问题及今后的发展方向。

Intrusion detection is an effective approach for dealing with the problems of network security. In this paper, firstly the necessity and the concept of intrusion detection are presented, and its models and techniques are described and analyzed. Then,a model of intrusion detection system with apperception ability is proposed. The model consists of three parts: rule based module, neural network module, and statistic analysis module. By combining misuse detection and anomaly detection, the system has good performance of identifying known attacks and detecting unknown attacks. Finally, the existing problem and the development trend of intrusion detection technology is concluded.