自适应型主机入侵防御系统的设计与实现  

Design and Implementation of the Adaptive Host Intrusion Prevention System

作　　者：吕滨[1] 关双城[1] 刘晓红[1] 张艳艳[1] 

机构地区：[1]黑龙江工程学院,黑龙江哈尔滨150050

出　　处：《计算机安全》2013年第7期21-24,共4页Network & Computer Security

基　　金：黑龙江省教育厅面上项目(项目编号:12531536)

摘　　要：系统基于API监控原理,针对个人主机资源有限和系统应用相对稳定的特点,按照精简的设计原则,利用Hooking技术截获API调用信息。在行为分析模式上,简化判定规则和执行逻辑,不需要复杂的行为分析算法和过程。系统的优势是具备动态的自动学习功能,通过前期的适应性训练,可以很快地适应用户系统并具备足够的入侵防御能力,对于防御频繁出现的非法访问和各种弹出窗口非常有效。The system intercepts the API call information using Hooking technology,according to the design principle of streamlined,in view of the characteristics of individual hosts with limited resources and relatively stable application,based on the principle of API monitoring.In the behavior analysis model the system simplifies the decision rules and execution logic,does not need the complex behavior analysis algorithm and process.The system has an advantage function of automotive learning,through adaptive training early,it can adapt to the user system quickly and have enough intrusion defense capability,and it is very effective for the defense of frequent illegal access and pop-up window.

关 键 词：主机安全 入侵防御 API调用 行为分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]