分布式入侵检测系统及其认知能力  

A Distributed Intrusion Detection System and Its Apperception Ability

作　　者：陈硕[1] 安常青[1] 李学农[1] 

机构地区：[1]清华大学信息网络工程研究中心,北京100084

出　　处：《软件学报》2001年第2期225-232,共8页Journal of Software

基　　金：国家863高科技发展计划资助!项目 (86 3- 317- 0 1- 99)&&

摘　　要：DIDAPPER( distributed intrusion detector with apperception)系统是一种具有认知能力的分布式入侵检测系统 .分布式结构、认知能力和知识的共享是该系统的重要特点 .重点讨论了 DIDAPPER系统的认知能力 .流量标本和 IP陷阱是 DIDAPPER系统所提出的新概念 .它们可以获取和识别异常的流量数据 ,而且适合于检测大规模网络攻击行为 .DIDAPPER系统的认知能力的另一个方面是神经网络的模式识别方法 .将具有自学习能力的BP网络应用于流量分析 ,很好地解决了流量模式的识别问题 .The DIDAPPER (distributed intrusion detector with apperception) system presented in this paper is a distributed intrusion detector with apperception. The distributed architecture, the apperception ability and the sharing of knowledge are evident characteristics of the DIDAPPER. This paper focuses on the apperception ability of DIDAPPER. Traffic specimens and IP traps are DIDAPPER's new concepts, which can capture and recognize abnormal traffics and are suitable for monitoring the large scale network attacks. The other aspect of DIDAPPER's apperception ability comes from the neural network algorithm. The BP neural network with learning ability has been applied to traffic analysis, and shows good effect on the recognition of traffic patterns.

关 键 词：分布式入侵检测系统 认知能力 网络安全 计算机网络 INTERNET 

分 类 号：TP393.408[自动化与计算机技术—计算机应用技术]