网络环境下自适应入侵响应系统的研究  

Research on adaptive intrusion response system in network

作　　者：王增权[1,2] 王慧强[1] 张瑞杰[3] 

机构地区：[1]哈尔滨工程大学计算机科学与技术学院 [2]哈尔滨市房产住宅局档案信息中心哈尔滨150010 [3]哈尔滨医科大学

出　　处：《电子测量技术》2007年第4期74-76,92,共4页Electronic Measurement Technology

基　　金：国防"十五"预研基金(413150702)资助项目

摘　　要：目前,社会上对入侵检测系统产品的开发设计研究得很多,而对入侵检测系统的性能进行综合评价以及评价指标的研究很少。本文利用入侵响应警报矩阵,对入侵检测系统的性能指标进行了分析,对检测正确率、漏报率、误报率、警报可信度和IDS效率进行了分析。利用数学方法分析了入侵检测系统的警报可信度、攻击频率、风险评估和响应成本,对自适应入侵响应系统的损失评估和响应成本进行了数学分析,对入侵响应策略进行了研究,而且对根据环境变化动态调整安全策略的自适应入侵响应系统进行了研究。Nowadays, there are many products of intrusion detection system, while research on the assessment of these products is rare. Based on the intrusion response alarm matrix, the paper analyzed the performance index of the intrusion detection system, the probability of correction for inspect, false positive, false negative, alarm reliability and IDS efficiency. It takes a mathematical analysis of the alarm confidence level, the attack frequency, the risk assessment and the response cost of IDS, analysis of the tactic of IRS. Research on adaptive intrusion response system （AIRS） that is able to make automated response and adjust security policies according to the environmental variation dynamically is made.

关 键 词：自适应入侵响应系统 报警可靠性 响应策略 响应代价 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]