摘要： 对攻击进行分类,可以使攻击检测系统化,有助于构造高效的检测方法,从而改善IDS的性能。该文提出一种以IDS可直接收集的数据为基础、面向检测的攻击分类方法。进而将该方法应用于所有可在IDS网络数据源中检测出的攻击,提出DetectClass分类方法,用Z语言描述并证明其正确性;接着据此构造相应的检测方法。基于DetectClass攻击分类方法,设计开发原型系统DC-NIDS。

关键词: 入侵检测系统, 面向检测的攻击分类, 检测方法

Abstract: Attack classification helps to build efficient and realtime intrusion detection method. In this paper, a detection-oriented attack classification method, based on data that IDS can collect directly, is proposed. Then the method is applied to classify attack that can be detected through network packet. DetectClass attack classification method is presented, and corresponding detection method is given. At last, a prototype system is designed and implemented.

中图分类号: 

• TP393.08