基于安全状态信息库的入侵检测系统研究  

A Study Based on Intrusion Detection System of Security Status Information Base

作　　者：王斌 何鹏[2] 张德和 张涛 

机构地区：[1]总参陆航研究所,北京101114 [2]西安通信学院,陕西西安710106

出　　处：《计算机安全》2010年第2期32-34,共3页Network & Computer Security

摘　　要：主要介绍了入侵检测系统的相关概念、分类和入侵检测算法,在对各种技术进行分析、比较的基础上提出了基于安全状态信息库的入侵检测系统。该系统通过建立系统安全状态数据库,在考虑入侵行为的同时也考虑到了受保护系统的防范能力;通过建立可疑主机数据库,对不同威胁级别的主机可以采用不同的检测和响应手段。First, basal definition, classification of Intrusion Detection System and the algorithms of Intrusion Detection are presented in this paper. Based on the analysis and comparing of various technology, Intrusion Detection System based on security state information database is presented, By creating security status information database, intrusion behavior is considered as well as the defense ability of protected system; by creating database of suspicious hosts, different detection and respond method can be used in hosts with different threatening level.

关 键 词：网络安全 信息库 入侵检测系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TV66[自动化与计算机技术—计算机科学与技术]