基于Windows系统主机的入侵防御系统设计  

Design of intrusion prevention system based on Windows host

作　　者：王洋[1] 祝跃飞[1] 孙晓妍[1] 

机构地区：[1]解放军信息工程大学信息工程学院,河南郑州450002

出　　处：《计算机工程与设计》2007年第19期4606-4608,4611,共4页Computer Engineering and Design

摘　　要：随着计算机技术的不断发展,针对主机的入侵和攻击不断增多,入侵手法也不断变化。包括木马r,ootkit等恶意软件对计算机用户的个人信息安全造成极大损害。通过对入侵的一般模式进行分析,设计并实现了基于Windows系统主机的入侵防御系统,以行为监控为基础,对主机进行监控,并中止异常行为的运行,及时保护系统。防御系统结合多种监控手段实现,分别从应用层和内核对主机进行保护,对已知和未知攻击都具有较好的防御能力。With the development of computer technology, intrusions and attacks aiming at host grows more and more, and intrusion measures are changing incessantly. Malwares including trojans and rootkits do great harms to computer users＇ personal information security. An intrusion prevention system based on Windows host is desighed and realized through analysing the general intrusion mode. The prevention system based on monitoring and controlling the host＇s behaviors prevents abnormal behaviors and protects the host in time. The system is realized through multiple monitoring and controlling technology and protects the host at user mode and kernel mode. The system protects host from known and unknown attacks well.

关 键 词：入侵防御 系统调用 监控 规则 行为 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]