自动入侵响应系统的研究  

A Study of Automated Intrusion Response Systems

作　　者：丁勇[1] 虞平[1] 龚俭[1] 

机构地区：[1]东南大学计算机科学与工程系江苏省计算机网络技术重点实验室,南京210096

出　　处：《计算机科学》2003年第10期160-162,166,共4页Computer Science

基　　金：国家自然科学基金 (No.90104031)

摘　　要：1.引言 随着计算机网络的不断发展和普及,安全问题日益严重,已成为当今研究的重点.从CERT每年的安全事件报告可以看出,安全事件的数量从1989年的6例上升到1999年的8268例[1],计算机网络的安全问题引起了广泛的关注.The emergence of automated and complex attacks imposes great threat on the network. The automated intrusion response system is able to take timely countermeasures to stop the attacks and decrease the loss of systems This paper analyzes the several requirements of an ideal automated intrusion response system, introduces the general architecture of automated intrusion response systems, summarizes the possible countermeasures that make the basis of the research, and focuses on the introduction of three important techniques, including cost-sensitive model, plan recognition, and the self-adaptive technique. The combination of these techniques helps to construct a reasonable, timely, and self-adaptive automated intrusion response system. In the end of this paper, we make a brief introduction of the cooperation techniques that is used in large scale networks.

关 键 词：计算机网络 入侵检测系统 自动入侵响应系统 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]