一种基于混合模式的Web入侵检测系统架构研究  

Research on Web Intrusion Detection Module Based on Hybrid Framework

作　　者：张明 许博义 许飞 

机构地区：[1]信息系统安全技术重点实验室,北京100101

出　　处：《信息网络安全》2015年第9期6-9,共4页Netinfo Security

摘　　要：Web入侵检测系统对Web访问进行实时监控并能及时发现针对Web的攻击行为,能有效解决Web所面临的安全问题。文章分析了当前Web入侵检测技术的优势和不足,提出一种基于混合模式的Web入侵检测架构,该架构集成了基于特征的Web入侵检测模块和基于异常的Web入侵检测模块。基于特征的Web入侵检测模块主要用于检测各种已知的、易于提取特征的攻击,基于异常的Web入侵检测模块主要用于检测各种未知的、难以被基于特征的Web入侵检测模块发现的攻击。混合架构能有效提高攻击的检测率。Web intrusion detection system can monitor Web access transactions in real-time and detect attacks in time, which can solve the Web security problems effectively. This paper analyzes the advantages and shortcomings of the current Web intrusion detection techniques, and then proposes a Web intrusion detection hybrid framework. The hybrid framework integrates a signature-based detection module and an anomaly-based detection module. The signature-based detection module is mainly used to detect those known attacks, which easily are extracted features. The anomaly-based detection module is mainly used to detect those unknown attacks, which can hardly be detected by the signature-based module. The hybrid framework achieves a higher detection rate.

关 键 词：Web入侵检测 混合架构 基于特征的检测模块 基于异常的检测模块 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]