基于漏洞扫描的入侵检测规则屏蔽方法研究  

STUDY ON MASKING INTRUSION DETECTION RULES BASED ON VULNERABILITY SCANNING

作　　者：张春瑞[1] 王开云[1] 高行宇[1] 赵伟锋[1] 

机构地区：[1]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《计算机应用与软件》2008年第7期259-260,282,共3页Computer Applications and Software

摘　　要：网络入侵检测系统的规则数在不断地增加,规则匹配的过程越来越复杂。在高速网络的环境下,NIDS(Network Intrusion Detection System)难以适应,产生漏检。将漏洞扫描与入侵检测进行融合,通过对保护对象扫描,找出存在的漏洞,根据漏洞信息将无用的规则屏蔽。实验结果表明,可以大量减少无用的检测规则;同时可以减少相应的警报信息。提高了检测效率、降低丢包率。Rules of Network Intrusion Detection System （NIDS） are increasing, and rules＇ matching course is also becoming more compli- cated. NIDS is hardly to accommodate to this circumstances in high-speed network and often loses packets in detection. To integrate vulnera- bility scanning and NIDS is an effective method. Vulnerability scanning checks the protected object and finds its vulnerable information, and then NIDS masks useless rules according to the checked information. The experiment indicates that NIDS can reduce lots of useless rules and decrease corresponding alerts. It also shows that NIDS increases the efficiency and decreases the of packet loss rate,

关 键 词：入侵检测 漏洞扫描 屏蔽规则 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP393.09[自动化与计算机技术—计算机科学与技术]