Abstract: As the recent distributed denial-of-Service attacks springs, no open computer network is immune from intrusions. So, intrusion detection systems need to be updated timely whenever a novel intrusion surfaces and geographically distributed IDS need to cooperate to detect distributed and coordinated intrusions. This paper builds a framework which can discover detection models and exchange them based on the data mining approach and CIDF standard.

摘要： 随着DDOS(分布式拒绝服务)攻击的兴起，互联网上的开放主机几乎很难摆脱其困扰。在这种新的情形下，要求IDS能及时检测新的攻击和更新自身的检测规则，尤其是要求地理上分布的各个IDS能够协同起来。该文中，把数据挖掘的方法运用到IDS，建立基于数据挖掘方法的IDS规则挖掘引擎。在此基础上，为了解决协同问题，提出把DME(数据挖掘引擎)嵌入到CIDF的思路，形成协同交换框架，应对分布式攻击。

关键词: 数据挖掘, 入侵检测, 入侵模式, 通用入侵检测框架, 协同

CLC Number: 

• TP311.13