基于Linux的入侵检测系统协同性研究与设计  

Research and Design of the Cooperativity for an Intrusion Detection System Based on Linux

作　　者：单家凌[1] 

机构地区：[1]广东白云学院计算机系,广东广州510450

出　　处：《测控技术》2012年第6期111-114,119,共5页Measurement & Control Technology

摘　　要：针对主机入侵检测系统(HIDS)的缺点,提出了一种以日志数据库为连接枢纽的新型防御结构模型(H-HIDS)。该结构模型中,蜜罐为HIDS提供补充性的日志数据,入侵行为重定向将HIDS检测到的可疑数据流导向蜜罐,目的是充分利用它们各自的优点,互相分工,协同工作,发挥出它们各自最大的优势,以达到保护特定主机系统最大安全性。通过实验,H-HIDS在报警率和误报率方面具有一定的优越性。For disadvantages of the host-based intrusion detection system（ HIDS）, a log database for connecting the hub to the new defensive structure model is proposed. In the structural model, honeypot provides comple- mentary log data for the HIDS, intrusion redirects the suspicious data flow detected by HIDS to the honeypot, which is to fulfill their respective advantages, each division, working together to play their respective advanta- ges, in order to achieve maximum security for the protection of a particular host system. Through experiment, the H-HIDS has certain superiority in alarm rate and false alarm rate.

关 键 词：蜜罐 主机入侵检测系统 协同性 H-HIDS 

分 类 号：TP393.02[自动化与计算机技术—计算机应用技术]