基于语法分析树的入侵检测技术  

Intrusion detection technology based on parsing tree

作　　者：贾存虎[1,2] 仇德成[2,3] 李大伟[2] 徐德启[2] 

机构地区：[1]酒泉卫星发射中心,甘肃酒泉735000 [2]兰州大学信息科学与工程学院,甘肃兰州730000 [3]河西学院计算机系,甘肃张掖734000

出　　处：《计算机工程与设计》2009年第18期4220-4223,共4页Computer Engineering and Design

摘　　要：对系统入侵的状态转换进行了研究,分析了常见的黑客攻击方法,包括TCPSYNFLOODING、IP分片攻击等。针对现有入侵检测技术的不足,构建了一个新的入侵检测模式,提出了基于特征信息序列语法分析的入侵检测技术。实现多种入侵用统一的文法描述,有效地避免了检测分析中的盲目试探,提高了检测效率。由于采用了可扩展的文法创建技术,使其具备一定的异常检测能力,能识别未知的入侵或攻击。At first, researching the state conversion of system intrusion, analyzing some famous attacking methods, such as TCP SYN FLOODING, IP FRAGMENT OVERLAP and so on, according to defect of the existing intrusion detection technology, a new intrusion detection model is aecomplisbed, intrusion detection technology based on characteristic information sequence parsing is proposed. It can realize that a variety of network or system intrusion will be described the same pattern, can avoid blindness of the probing, the effieiency ofdetection will be improved greatly. Asscalabilityofthegrammarereatingtechnology, the intrusion detection system is made to be certain anomaly detection capabilities, can recognition unknown intrusion or attack.

关 键 词：攻击方法 入侵检测 状态转换 特征信息序列 语法分析树 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]