摘要： 由于每种检测手段都有各自的优缺点,任何一种单独的检测手段或方式都不能够检测出所有的入侵行为。为了弥补这些缺陷和不足,该文提出了一种基于系统呼叫和网络数据包的两层入侵检测模型,这种模型有机地把两种入侵检测技术融合在一起,极大地提高了系统的安全性能。结果也表明,这种检测模型具有更好的检测效果和健壮性。

关键词: 网络入侵检测, 主机入侵检测, 系统呼叫, 两层检测模型

Abstract: For each single detection measure or model, there are undetectable intrusion types. To overcome this drawback of single-measure anomaly detector, the two-layer intrusion detection model is provided . This kind of intrusion detection model combined the network intrusion detection and system call based intrusion detection technology to detect both known intrusion and novel intrusion. The results show that the two-layer intrusion detection model is more effective and robust.

中图分类号: 

• TP393