基于空间扩维特征的主机入侵检测模型  

Spatial Expended-Dimension Character Based Host Intrusion Detection Model

作　　者：皮建勇[1] 刘心松[1] 吴艾[1] 符青云[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都610054

出　　处：《计算机辅助设计与图形学学报》2007年第11期1482-1488,共7页Journal of Computer-Aided Design & Computer Graphics

基　　金：四川省应用基础研究项目(04JY029-017-2);科技型中小企业技术创新基金(04C26225110223)

摘　　要：在基于访问控制粒度和多维安全拓扑空间的基础上分析了入侵攻击的特点,并提出基于空间扩维特征的入侵检测模型——SEDIDS.为访问控制系统中的实体建立了语义网络模型,用语义网络完备性推理来检测访问控制实体的完整性,作为入侵攻击行为判断的依据,从而取代了依赖训练数据集建立系统访问模式轮廓进行比对的入侵检测传统手段.实验结果表明:该模型相对于传统的入侵检测具有较低的漏报率和误报率,并有较高的运行效率.We analyze the characteristic of intrusion attack based on access control granularity and multi-dimension secure topological space, and propose a spatial expended-dimension character based intrusion detection modeI--SEDIDS. We construct the semantic net model for the object of access control system, and detect the integrity of access control object by the complete reasoning on semantic net, which is used as the evidence of intrusion detection. The proposed model replaces the traditional method which only depends on the comparison of system access profile constructed by training dataset. The experimental results show that this model obtains low false positive rate and low false negative rate, and is of high efficiency.

关 键 词：访问控制 多维空间 SEDIDS 入侵检测 语义网络 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]