基于行为模型算法的入侵检测技术研究  

Study on intrusion detection system based on behavior modeling

作　　者：陈涛[1] 曹作良[1] 朱辉[1] 

机构地区：[1]天津理工大学机械工程学院,天津300191

出　　处：《天津理工大学学报》2006年第1期29-32,共4页Journal of Tianjin University of Technology

基　　金：天津市科技攻关专项基金(04310791R)

摘　　要：在分析现有的入侵检测技术的基础上,提出基于行为模型的入侵检测技术.通过学习模式和检测模式来分析行为模型算法.本文从UR I检测、客户请求的数据检测及访问顺序检测这3个部分来阐述基于行为模型的入侵检测技术的检测原理.经过测试,行为模型算法对现有的攻击(如SQL注入攻击、跨站脚码攻击、隐藏域攻击)能起到有效的防御;对现今未发现的攻击行为,在它出现后可以通过学习、建模也能进行很好的检测.This study analyses the present intrusion detection technology and processes the intrusion detection based on behavior modeling. Through studying model and detection model , it can analyse the behavior modeling arithmetic. This paper states the principle of Intrusion Detection based on behavior modeling , through URI ,the required data and access consequences. Through testing, it has been proved that this system can defend most of the existing attacks at present, such as Hidden Field. And it can detect the attack that is not found now ,through the studying and modeling after it appears.

关 键 词：入侵检测系统 行为模型 规范文件 

分 类 号：TP368.6[自动化与计算机技术—计算机系统结构]