基于状态转换图的入侵检测模型STGIDM  

A Intrusion Detection Model STGIDM Based on State Transition Graph

作　　者：姚立红[1,2] 黄皓[1,2] 谢立[1,2] 

机构地区：[1]南京大学计算机科学与技术系,南京210093 [2]南京大学计算机软件新技术国家重点实验室,南京210093

出　　处：《计算机科学》2003年第11期99-101,共3页Computer Science

基　　金：国家"863"高技术(NO:2001AA142010)经费资助

摘　　要：近年来,计算机系统的安全问题日益突出,相应的安全防范技术也成为了人们研究的热点.入侵检测技术作为一种重要的安全技术,从80年代中期就已经引起人们的注意[1],与其它安全技术相比(如身份认证、访问控制等),入侵检测技术具有鲜明的特点:其它绝大多数安全技术主要强调预防或阻止外来入侵者进入系统,或者控制内部用户获取非法权限;而入侵检测主要在其它安全措施被突破、入侵者正在(或已经)进入系统的情况下发挥作用,该技术主要通过监视系统中的异常行为,及时发现入侵者,并采用相应措施(如断开网络连接、报告管理员等),以避免或尽可能减少入侵造成的损失[2].Pattern Match based on the serial of system calls is one of the widely used intrusion detection technologies, while the courses that cause intrusion frequently accord with chosen pattens when programs monitored are complex and the number of chosen patterns is large, which always causes some intrusions to be neglected. In this article, a new Intrusion Detection Model based on State Transition Graph is put forward.In this model, the programs' properties are accurately reflected by State Transition Graph, and transitions are introduced between states that aren't conjoint. Moreover, the number of transitions between states that aren't conjoint is one of key factors to deduce intrusions during matching.

关 键 词：网络安全 状态转换图 入侵检测模型 STGIDM 系统调用序列 模式匹配 性能分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]