基于网络引擎入侵检测系统的研究与实现  

Research and implementation of intrusion detection system based on network engine

作　　者：殷锋社[1] 

机构地区：[1]陕西工业职业技术学院

出　　处：《电子设计工程》2011年第7期92-95,99,共5页Electronic Design Engineering

摘　　要：基于滥用和基于异常的检测模型是IDS系统两大检测模型,其对应的技术即为网络引擎和主机代理。本文主机代理采用基于异常的模型进行入侵检测,与数据库中存储的入侵特征库进行比较,从而判断是否是一次攻击,从而实现一个网络引擎可以监视具有多台主机的整个网段,通过网络引擎实现企业网络中所有组件不受攻击。The detection model based on abuse and based on anomaly are two test models of IDS system,and the corresponding technologies are the network engine and the host agent. The host agency in this paper is based on anomaly model to realize intrusion detection.Comparing with intrusion character which stored in the database, it can determine whether it is an attack. So that it realizes a network engine can monitor the whole network with multiple hosts,and all components of the enterprise network can be secrued from attack by the network engine.

关 键 词：检测模型 网络引擎 主机代理 特征库 

分 类 号：TP3-05[自动化与计算机技术—计算机科学与技术]