基于网络状态的入侵行为描述及存储方法  

Network state based on intrusion action describe and storage method

作　　者：金晓燕[1] 张来顺[1] 张晗[1] 费金龙[2] 

机构地区：[1]信息工程大学电子技术学院,河南郑州450004 [2]信息工程大学信息工程学院,河南郑州450002

出　　处：《计算机工程与设计》2006年第3期453-456,共4页Computer Engineering and Design

摘　　要：提出了一种基于正则语言描述的网络状态入侵行为方法。该方法结合网络入侵的目标和特点,利用有穷自动机理论,基于网络协议来实现进程和操作系统的状态建立,从而可以发现未知的入侵。论证了应用该方法的可行性,利用通用入侵检测框架CIDF对应用这种方法的入侵检测系统进行了描述,并讨论了该系统实现时攻击描述的判断和存储方式,最后与其它入侵行为方法进行了比较。First, a network state intrusion action method based positive language describing was presented. This method is established by using DFA theory, characters and goals of net-attacks and fully depending on states of the processes of net protocols and operation system, so it could discover unknown attacks. It was proved that the method was feasible for intrusion detection and described IDS that using this model to describe net-attacks by CIDF （Common Intrusion Detection Framework）. Then the method＇s storage and implement were discussed. In the end, the method was compared with other intrusion detection descriptions.

关 键 词：入侵行为 有穷自动机 网络状态 通用入侵检测框架 存储 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]