摘要： 提出了一个多层次的基于用户操作的入侵检测模型,并实现了其原型系统。在此模型中,检测系统从个层次监控用户在被保护计4算机系统上进行的操作,监测结果经过信息融合得到最终的入侵判断。该模型能够更容易地发现用户的异常行为,同时有效降低误报。结合原型实现还讨论了在各层次进行入侵检测的方法。

关键词: 网络安全, 入侵检测, 信息融合

Abstract: In this paper we present a multi-layer and defense-in-depth intrusion detection model for networked computer systems with a prototype. In this model, the operations on the protected computer system are monitored by four sensors from different viewpoints. The final judgement is made by combining the results of the individual sensors using information fusion techniques. It is demonstrated that an anomaly behavior can be more easily discovered and false alarms can be effectively reduced using our detection model. The methods to detect intrusions at different layers are also discussed using the experience gained in prototype realization.

中图分类号: 

• TP393.08