基于协议分析的入侵检测系统模型的研究  

The Research of an intrusion detection system modern based on protocol analysist

作　　者：贾涛[1] 卢军从[2] 王昕[3] 

机构地区：[1]宁波大红鹰学院,浙江宁波315175 [2]北京华胜天成科技股份有限公司,北京100085 [3]浙江纺织服装学院机电与信息学院,浙江宁波315211

出　　处：《计算机安全》2009年第7期37-41,共5页Network & Computer Security

摘　　要：在对比传统的入侵检测系统模型的基础上,通过分析检测模式匹配的特征方法与协议分析相互结合,构建了一种基于协议分析的入侵检测模型,并且从软件方面设计了该模型。最后通过对该模型的软件测试与分析,证明了基于协议分析的入侵检测系统的模型具有较少的计算量,避免了对内容的比较而产生的误报,从而提高系统的效率。另外,由于协议格式定义只与协议相关,与网络的结构、类型无关,所以该模型具有很广泛的适用性。In contrast to traditional intrusion detection system model,and to analyze the characteristics of pattern-matching method and protocol,a new intrusion detection model is built and designed from the software. Finally,to test and analysis the model from software.The Conclusion proved that the intrusion detection system model with less computation to avoid the comparison of the content resulting from false positives, thereby enhancing the efficiency of the system. In addition, definition of protocol format is only relevant to protocol, and has nothing to do with the network structure, so the model has very broad application.

关 键 词：入侵检测 数据捕获 协议解码 模式匹配 模型 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP311.5[自动化与计算机技术—计算机科学与技术]