利用SNMP代理实现基于状态机的入侵检测.PDFVIP

31 5 Vol.31　No.5 　2005 9 CHINA MEASUREMENT TECHNOLOGY Sept, 2005 　　　　　 SNMP 闫　华 (, 200433) 　:, SNMP 。 PTSL , Script MIB , RMON2 MIB 。 , , , 。 : ;;;SNMP ; :TN915.08　　　　:A 　　　　:1672-4984(2005 )05-0096-04 Detection of intrusion status based on SNMP proxy YAN Hua (In ormation O ice, Fudan University, Shanghai 200433, China) Abstract:A ter discu ssing the present intrusion detection systems and methods and analyzing their de ects, the author presented SNMP agent system based on intru sion status detection.The characteristics o intrusion and attack w as described by protocol Trace Speci ication Language(PTSL)signatures, Script MIB was used to con igure the intrusion detection agent.RMON2 MIB w as u sed to store statistical in ormation about intrusion signature occurrences.Experiment show s that attack characteristics can be precisely described and alse alarms are greatly reduced.Full integration o IDS and NMS is achieved. Keywords:Netw ork security;Intrusion detection;Network management;SNMP agent;Finite state machine 1　　 , 。 、 , 50%。 , , 。 (IDS Intrusion Detection System) 。 。, 80 。(DDOS 。, Distributed Denial o Service) IDS 。 , , , IDS 100 %。 。 , , ; , 。 ; , 。 。 。, , 。。 , 。, , 。