基于引擎划分的入侵检测系统模型分析  

Analysis on the IDS models according to engine

作　　者：张莉[1] 

机构地区：[1]广东女子职业技术学院,广东广州511450

出　　处：《信息通信》2012年第4期122-123,共2页Information & Communications

摘　　要：入侵检测系统是保护网络安全的手段之一,在选择入侵检测系统时,其引擎是基于签名检测还是异常检测是决策的关键点。文章从技术角度分析了两种模型的优势及不足,在实际应用中,可以根据保护对象的特点,灵活部署入侵检测系统,如果需要提供更高的保护策略,应该使用两者兼顾的产品。IDS is one of the means to protect network security.In the select of IDS,it is the key point of the decision-making that its engine is based on signature detection or anomaly detection.This paper analyzed the advantages and disadvantages of these two models from the technical perspectives.In practical applications,we found we can flexibly deploy the IDS according to the characteristics of the protect objects.However,if we need a higher level of protection strategy,we develop the products which contain these 2 functions.

关 键 词：入侵检测系统 签名检测 异常检测 模型 威胁 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]