摘要： 主要研究了异常检测和滥用检测两大类入侵检测的方法，比较了各种方法的优缺点以及可能的改进，并给出了分析这两类检测方法后的结论。

关键词: 入侵检测系统, 异常检测, 滥用检测, 审计日志, 特征文件, 入侵特征

Abstract: This paper focuses on the approaches of anomaly detection and misuse detection of intfusion detection system. It mainly studiesthe approaches of detection, compares disadvantages and advantages of different approaches, and discusses possible improvements. At first,approaches of anomaly detection are introduced, which include statistical approach, predictive pattern generation approach and neural networkapproach. Anomaly detection technique assumes that all the intrusive activities are abnormal, it identifies intrusion attempts by comparingsystem states with the normal profile. Thus it can detect unknown detection. Then some misuse detection approaches are presented, whichinclude expert system, model based approach, state transition analysis system and pattern matching approach. The principle of misusedetection is the attacks or intrusions, which can be expressed in patterns or signature. In this way, hitrusion or its variation can be detected bypatterns matohing. It can only detect most of or all known intrusive patterns. At last, a summary about these two kinds of detectionapproaches is given.

中图分类号: 

• TP393.08