摘要： 入侵特征对于入侵检测系统至关重要，它们往往由系统属性和事件序列组成，时序关系是描述它们的关键。ISITL(Intrusion Signatures based on Interval Temporal Logic)是一种较高抽象程度的入侵特征形式化描述语言，它对Allen的时段时态逻辑进行了实时描述的扩充，从而加强了其入侵特征的描述能力。在ISITL中，所有的系统属性和事件都与相应的时段紧密相连，其相互关系用13个基本函数和3个扩展函数来描述。与其它入侵特征描述语言相比，ISITL具有简单易用，描述能力强等优点。
关键词:
入侵特征,
入侵检测系统,
时段时态逻辑,
ISITL
Abstract: Intrusion signatures are important in intrusion detection system,they are usually composed of the system attributes and event sequences, in which time plays a critical role. Interval temporal logic based intrusion signatures(ISITL) is a high-abstractive formal description language for representing intrusion signatures. It binds all system attributes and events with corresponding intervals, whose relations are specified by 13 basic functions and 3 spread functions. Compared with other competitive languages, ISITL is simple and more expressive.
中图分类号:
欧阳明光,潘峰,汪为农. 入侵特征的时间语义分析及实现[J]. , 2004, 30(10): 9-.
OUYANG Mingguang, PAN Feng, WANG Weinong. Time Language Analysis and Implementation of Intrusion Signatures[J]. , 2004, 30(10): 9-.