基于特征分析的网络入侵检测技术比较

Analysis of Signature Based Network Intrusion Detection

文章论述了基于特征分析的网络入侵检测技术的三种方法:模式匹配、协议分析和状态协议分析,分析了它们的工作原理。并通过包括SYNFlood、拒绝服务攻击、Nimda病毒和FTP缓冲区溢出等攻击实例详细说明他们不同的解决问题能力。

Signature based network intrusion detection becomes more and more important in network security.This paper introduces three analytical technology of signature based network intrusion detection:Pattern Matching,Protocol analysis and Stateful Protocol analysis.Their different abilities to detect the intrusions are discussed by several attack instances,including SYN flood,DOS,Nimda virus and FTP buffer overflow attack.