针对网络入侵检测系统的攻击及防御  

Attack against Network-based IDS and Solutions

作　　者：孙海彬[1] 徐良贤[1] 杨怀银[2] 

机构地区：[1]上海交通大学计算机系,上海200030 [2]江苏油田党校计算机教研室,扬州225261

出　　处：《计算机工程与应用》2002年第13期180-182,共3页Computer Engineering and Applications

摘　　要：Internet的使用越来越广泛,随之而来的网络安全已成为人们关注的焦点。入侵检测系统作为一种对付攻击的有效手段,已为越来越多的单位所采用。然而一旦攻击者发现目标网络中部署有入侵检测系统IDS,那么IDS往往成为他们首选的攻击目标。该文详细分析了针对网络IDS的几种攻击类型,即过载攻击、崩溃攻击和欺骗攻击,以及如何防御这些攻击,这对于IDS的设计具有一定的借鉴意义。With th e developing of Internet,the network security is becoming an important topic. Intrusion detection systems (IDSs)are effective tools for detecting attack,th erefore they are proliferating throughout corporate,government and academic c omputer networks.However,once a smart attacker finds an IDS installed in targe t network,he maybe attack such system firstly and disable it.In this paper,se veral attack categories against network-based IDS,including overload attacks, crash attacks and subterfuge attacks,are discussed in detail,and some solutio ns to defend attack are proposed.IDS designers can find some useful informati on in this paper.

关 键 词：入侵检测系统 攻击类型 网络安全 INTETNET 计算机网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]