Abstract: The study background and significance of system evaluation and intrusion detection are introduced in this paper. The contentsand methodology of intrusion detection are presented from the view of attack strategy. By classifying the detection principle into behavior-based and knowledge-based method, a generic intrusion detection model is introduced, and the respective implement measures, advantagesand disadvantages are addressed.

摘要： 简要介绍了系统评估和入侵检测的研究背景和意义。从攻击策略的角度，阐述了入侵检测内容和方法，并介绍了具有通用价值的入侵检测模型。通过总结将检测原理分为基于行为和基于知识两大类，分别阐述了各类方法的具体实现手段和各自的优缺点。

关键词: 入侵检测, 审计跟踪, 行为特征

CLC Number: 

• TP303