一个高效的包处理入侵检测模型  

AN EFFICIENT INTRUSION DETECTION MODEL BASED ON PACKET PROCESSING

作　　者：王旭[1] 叶震[1] 夏竹青[1] 

机构地区：[1]合肥工业大学计算机与信息学院,安徽合肥230009

出　　处：《计算机应用与软件》2010年第11期276-278,共3页Computer Applications and Software

摘　　要：提出了一个高效率的包处理入侵检测模型。包俘获装置俘获网络数据包就直接对其进行检测,而不是重组这些数据包后进行检测,这样就提高了检测的效率。现有的入侵检测产品为了降低系统的漏报率,均采用包重组机制。提出的模型将包重组机制和数据包关联处理进行结合,该模型在保证了检测攻击完整性的基础上提高了检测系统的效率。This paper presents an efficient intrusion detection model based on packet processing.When the network packets are captured, this packet capture device will detect them direcdy rather than doing this after reassembling them,thus the efficiency of detection is improved. Existing intrusion detection products,in order to reduce missing report rate,all use the mechanism of packet reassembly.The model presented in this paper integrates the mechanism of packet reassembly and the associated disposal of data packets,so the model improves the efficiency of detection system on the basis of ensuring the integrity of attacks detection.

关 键 词：高效 包重组 包处理 入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]