摘要： 首先介绍了计算机网络安全审计的概念、国际上对安全审计的一般认识以及CC标准对信息系统安全功能中的审计功能的定义，然后介绍了一套分布式多层次审计系统的方案及特点，以及在这个审计系统中采用的一些技术和算法。

关键词: 网络安全审计, 信息监控, 入侵检测

Abstract: A network security auditing system to a information system is the black box to a plane., It catches more and more attenhons ofthe system administrators.According to Ihe definition of CC criteria, the security audit function requirement includes these families: Security audit automaticresponse, Security audit data generation, Security audit analysis, Security audit review, Security audit event selection and Security audit eventstorage.Following the requirement of CC criteria, we designed a network security audit system that has the following functions: (1)Monitoring the abnormal operations on the network; (2) Collecting the audit data from the operation system and application system; (3)Real-thoe Alarming; (4) Network Connection Control; (5) Maintenance of Audit records; (6) Rule defining.This network security audit system has a distributed structure, which is composed of an audit center, a group of audit device that act asmonitors on network, and a group of software modular that act as the agents in various systems. It can perform the security audit in networklayer, system layer and application layer.The technique points that are introduced are: Intrusion detecting rules, Audit Protocol and By-pass Control.

中图分类号: 

• TP393.08