摘要： 根据事件分级的思想，结合历史事件序列的相关性对入侵进行分析,给现有的入侵事件划分了安全级别，并在此基础上提出了级别转换算法，解决了以前的入侵检测系统中只对单个事件进行分析的缺点,使入侵检测系统具有预警功能,并可以对黑客攻击的将来步骤进行预测。该文还对基于该思想实现的入侵检测系统的数据处理流程、软件体系结构、脚本语法规则进行了介绍。

关键词: 入侵检测系统, 脚本, 状态转换, 软件体系结构

Abstract: This paper is based on the idea that attacking events have levels. It uses the relevance of historical event sequence to analyze network intrusion and classify the levels of events. Based on above ideas, it puts forward a level transition algorithm and solves the shortcoming of former intrusion detection systems (IDS) that only analyzes discrete event. This method makes the IDS have the ability to forecast future alarms and actions that hacker will take. The paper also represents the detailed implementation of the IDS based on the basic ideas and introduces the data processing progress, software architecture, and grammar of event script.

中图分类号: 

• TP393.08