摘要： 为发现包含多个站，点的协同攻击，各入侵监测系统共享信息是至关重要的。公共入侵监测系统架构（CIDF）便是迈向使不同的入侵监测与响应（IDR）组件完成互操作的重要一步。尽管CIDF为某IDR组件理解另一组件发出的信息提供了基础框架和语言支持，但它并不包含使一个IDR组件向另一个组件要求特定信息的设施。这种设施的缺乏可能导致处理时间、存储容量与网络带宽的浪费。在CIDF采用的公共入侵规范语言（CISL）之上，提出了一种CISL的扩展形式以对CIDF组件间的询问活动建模。该扩展不仅简单而且与原有CISL保持一致。在扩展中，每次对信息的询问都被描述为由相关信息和可选的答复格式要求组成的模式。在对询问过程的建模中，模式的使用不但提供了一种表示查询的方式，还带来了对基于签名的入侵监测软件的重用可能。

关键词: 入侵监测, 互操作, CIDF

Abstract: In order to discover Coordinated attacks involving mulhple sites,it is essential for intrusion detection systems to shareinfomation.Common Inirusion Detection Framework(CIDF) is an important step towards enabling different intrusion and response (IDR)components to interoperate with each other.Although CIDF provides an infrastructure and language support that allows an IDR component tounderstand the infomation that is sent by another component,it does not contain a facility for an IDR component to request specificinformation from another component.The lack of such a facility may result in a waste of processing time,storage capacity and netWorkbandwidth.Thi paper proposes an ext6nsion to the Common Intrusion Specification Language(CISL),the language adopted by CIDF,to modelrequest among CIDF components.The extension is simple and consistent with the origina1 CISLEach request for information is described as apattern for relevant information and an optical format specification for the responding message.The use of pattern in modeling request notonly provides a way to represent queries,but also leads to a potential reuse of signature-based intrusion detection software.

中图分类号: 

• TP393.08