基于特征信息序列语法分析的入侵检测技术  

Research on Intrusion Detection Based on Sequence of Characteristic Information

作　　者：安云峰[1] 李春树[2] 骆岩红[3] 

机构地区：[1]西安通信学院,陕西西安710106 [2]宁夏大学物理与电气信息工程学院,宁夏银川750021 [3]西北民族大学计算机科学与信息工程学院,甘肃兰州730000

出　　处：《现代电子技术》2009年第13期89-92,99,共5页Modern Electronics Technique

摘　　要：针对滥用类入侵检测技术存在的不足,提出了基于特征信息序列语法分析的入侵检测技术。将同类型多种入侵用统一的文法描述,有效地避免了检测分析中盲目试探匹配过程及由此而产生的低效率问题。该技术总体上属于滥用检测技术的范畴,由于采用了可扩展的文法创建技术,使其具备一定的异常检测能力,因而兼备滥用检测和异常检测两类技术的优点,不仅能识别已知的入侵或攻击,对新出现的入侵也能及时发现。Aiming at shortcomings of the present technologies, this paper offers a new intrusion- detection technology which is based on sequence of characteristic information syntax analysis. Unified grammar description with a variety of types of invasion is effective way to avoid blind testing and matching process of the detection analysis and resulting inefficiencies. The present intrusion - detection technologies based on sequence of characteristic information syntax analysis could be described as a misuse of the checking technology. However, the discussed technology, using the expandable grammarcreated teehnique, is equiped with an ability of abnormity deteetion, so it overcomes the shortcomings of both misuse checking technology and abnormity detection one, not only can identify known invasion or attack on the emerging invasion also discovered in a timely manner.

关 键 词：入侵检测 特征信息序列 语法分析 属性文法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]