基于主动网的自适应入侵响应系统的研究  

Research on adaptive intrusion response system based on active-network

作　　者：游凤芹[1] 吴国新[1] 

机构地区：[1]东南大学计算机网络和信息集成教育部重点实验室,江苏南京210096

出　　处：《计算机工程与设计》2007年第4期792-795,865,共5页Computer Engineering and Design

摘　　要：对入侵检测系统(intrusion detection systemI,DS)的相关属性进行数学分析,根据报警可信度、响应成本、系统损失等因素的考虑,提出了基于最小代价的响应决策模型,该模型能够根据IDS的报警可信度和入侵响应系统(intrusion response sys-tem,IRS)的响应执行状况自适应的调整响应策略。在此基础上设计了基于主动网络的自适应入侵响应系统,采用主动网技术,使自适应响应系统具有更强的灵活性、可扩展性以及鲁棒性。A mathematical analysis of the properties of intrusion detection system （IDS） are given first, taking alarm confidence, response cost, and damage cost into consideration, a lowest cost-sensitive response decision modle is presented. This modle can adaptively adjust response measures by IDS＇s alarm confidence and intrusion response system＇s （IRS） response execution. An adaptive intrusion response system based on active network is designed. Intuitively, this system will provide more flexibility, expansibility and robustness.

关 键 词：入侵检测系统 入侵响应系统 响应决策模型 主动网络 自适应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]