利用SNMP代理实现基于状态机的入侵检测  

Detection of intrusion status based on SNMP proxy

作　　者：闫华[1] 

机构地区：[1]复旦大学信息办网络中心,上海200433

出　　处：《中国测试技术》2005年第5期96-99,共4页CHINA MEASUREMENT & TESTING TECHNOLOGY

摘　　要：在分析现有入侵检测方法及其缺陷的基础上,提出了一种基于状态机的入侵检测的SNMP代理方案。该方案利用基于有限状态自动机的协议轨迹规范语言PTSL描述入侵和攻击特征,利用Script MIB实现代理的配置,利用扩展的RMON2 MIB存储入侵检测的统计信息。最后通过试验表明,这个方案规范了攻击特征的精确描述,有效的减少了误报,实现了入侵检测系统和网络管理系统的有机结合。After discussing the present intrusion detection systems and methods and analyzing their defects, the author presented SNMP agent system based on intrusion status detection. The characteristics of intrusion and attack was described by protocol Trace Specification Language（PTSL） signatures,Script MIB was used to configure the intrusion detection agent. RMON2 MIB was used to store statistical information about intrusion signature occurrences. Experiment shows that attack characteristics can be precisely described and false alarms are greatly reduced. Full integration of IDS and NMS is achieved.

关 键 词：网络安全 入侵检测 网络管理 SNMP代理 有限状态自动机 

分 类 号：TN915.08[电子电信—通信与信息系统]