一种基于NDISIMD的入侵检测模型  

Model of Intrusion Detection Based on NDIS Intermediate Driver

作　　者：刘解放[1] 董方敏[1] 刘勇[1] 赵斌[1] 岳宇君[1] 

机构地区：[1]三峡大学电气信息学院,湖北宜昌443002

出　　处：《三峡大学学报（自然科学版）》2008年第3期83-86,共4页Journal of China Three Gorges University：Natural Sciences

摘　　要：基于对传统入侵检测模型和NDIS中间层驱动技术研究的基础之上,提出了一种基于NDIS中间层驱动的入侵检测模型IDMBN.IDMBN深入到Windows内核,可以较好地满足在网络底层检测和拦截入侵,解决了传统入侵检测在用户态或应用程序层不能够检测或漏检的问题,并在实际应用中取得了较好的性能,证明了该模型的可行性.On the basis of investigation to traditional intrusion detection model （IDM） and NDIS intermediate driver technology, intrusion detection model based on NDIS intermediate driver named IDSMBN is proposed. It is embedded into the kernel of windows; and it can satisfy detection and hold-up of intrusion at network low layers; it resolves the problems of traditional intrusion detection of non-detected or evaded network intrusion in user or applications layers and implements it with better performance; so the project feasibility is proved.

关 键 词：入侵检测 网络驱动程序接口规范 中间层驱动 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]