摘要
介绍了一个基于系统调用的灵活加载的入侵检测系统。该系统改进了常用的数据采集方法,采用虚拟设备驱动来获取系统调用。这种数据采集方法对系统影响小,可以灵活装卸,并提供标准的接口。数据分析融合了异常检测和误用检测两种方法,提出了相应的检测模型,并引入了滤噪函数。
The technology of Intrusion Detection is one of the important measures to protect the networks. Host-based intrusion detection is used to protect the key hosts. A flexible loading intrusion detection based on system-call was introduced in this paper. This system improved the common data collection method, and adopted virtual equipment driversto acquire system call. This method brings small influence on system, is easy to load and unload, and provides the standard interface. The data analysis integrates the two detection methods： anomaly and misuse, which provides corresponding detection models and introduces the noise filtering function.
出处
《计算机应用》
CSCD
北大核心
2006年第9期2137-2139,2144,共4页
journal of Computer Applications
基金
国家973规划资助项目(G1999035802)
国家杰出青年基金项目(60025205)
关键词
入侵检测
系统调用
虚拟设备驱动
滤噪函数
非层次聚类
intrusion detection
system call
virtual equipment drives
noise filtering function
nonhierarchical clustering
