可回卷的自动入侵响应系统1介绍.PDFVIP

可回卷的自动入侵响应系统1 张剑，龚俭 （东南大学计算机科学与工程系，江苏省计算机网络技术重点实验室南京 2 10096 ） 摘要：本文描述了入侵响应回卷的形式化方法及其实现，然后建立了一个可回卷的自动入侵响应系统 模型。该系统在检测到误报或入侵停止的情况下，采取响应回卷动作，从而消除了响应带来的负面影响， 即响应代价。试验证 ，通过计算入侵检测代价，响应回卷技术能较好地降低响应代价，从而以较低的代 价换取相同的安全目标。 关键词：入侵检测系统；自动响应系统；响应回卷；中止检测算法 中国法分类号：TP393 文献标识码：A 文章编号：030613 Rollbackable Automated Intrusion Response System ZHANG Jian, GONG Jian （Dept. of Computer Science and Technology, Southeast University, Nanjing, Jiangsu 2 10096, China ） Abstract: Traditional intrusion detection systems only carry out response when intrusion is detected, while don t respond to “nonexistence” of intrusion. That has two shortcomings. First, when the previous intrusion events that had been responded are proved to be false alarms, the response system cannot correct its response. Secondly, when the intrusion behavior terminates, the response system cannot withdraw the corresponding response so as to eliminate the negative effect. In this paper, a Rollbackable Automated Intrusion Response System (RAIRS) is established to cope with the above two problems. RAIRS can not only automatically direct response, but also detect false alarms and termination of intrusion, and then triggers the rollback of corresponding response to eliminate its negative effect. By calculating the cost of intrusion detection system, the experiment proves that the response rollback technique can decrease the response cost so that it can achieve the same security goal with lower cost. Key words: intrusion detection system; automated response system; response rollback; termination detection algorithm 一．引言 入侵检测系统（intrusion detection system，简称IDS ）的目的是监视计算机网络和系统， 以发现违背安全政策的行为。IDS 的主要功能包括检测和分析用户在网络中的活动，识别已 知的攻击行为，统计分析异常行为、检查系统配置和漏洞和入侵响应等。入侵响应是对入侵 事件所采取的措施，目的是为了抑止、评估和恢复入侵损失，甚至追踪