蜜罐与入侵检测技术联动系统的研究与设计  

Research and design on linkage system of Honeypot and intrusion detected technology

作　　者：翟光群[1] 陈向东[1] 胡贵江[1] 

机构地区：[1]郑州大学信息工程学院,河南郑州450001

出　　处：《计算机工程与设计》2009年第21期4845-4847,4867,共4页Computer Engineering and Design

基　　金：河南省科技攻关基金项目(0423020300)

摘　　要：针对单一技术在网络安全防御上的局限性,对入侵检测和蜜罐技术进行了认真研究。构建了一个新的入侵检测与蜜罐技术联动的防御系统。通过蜜罐收集入侵信息,用无监督聚类算法分析入侵数据,将数据集划分为不同的类别,提取新的攻击特征,扩充了入侵检测系统的特征库。通过实验分析和采用KDDCUP99入侵数据集进行测试,证明对于误报和漏报问题有一定的改进,提高了对未知入侵攻击的检测效率。For the limitations of single technology on the network security, a careful study on the Intrusion detected and Honeypot tech- nology is conducted, and a new defense system of intrusion detected and Honeypot technology linkage is set up. By collecting intrusion information with honeypot, instrusion data is analyzed by unsupervised clustering algorithm, and the data is divided into different parts and extract new attack features to elarge the intrusion detection system features library. Experiments and KDDCUP99 data test prove that the problem of false alarm and leaking alarm are improved and the efficiency of unknown intrusion detected is increased.

关 键 词：入侵检测 蜜罐 入侵特征 联动 无监督聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]