入侵检测与防御技术研究.doc

PAGE III PAGE 7 I 入侵检测与防御技术研究 摘 要 入侵检测系统是信息安全领域研究的热点问题。在阐述入侵检测系统概念和类型的 基础上，指出了当前入侵检测系统的优点及局限性。神经网络 、遗传算法、模糊逻辑、免疫原理 、机器学习、专家系统、数据挖掘、Agent等智能化方法是解决IDS局限性的 有效方法。介绍并着重分析了2种基于智能方法的IDS，提出了IDS在今后发展过程中 需要完善的问题。 防御技术是建立在内外网络边界上的过滤封锁机制，它认为内部网络是安全和可信 赖的，而外部网络被认为是不安全和不可信赖的关键词：IDS;入侵检测专家系统;人工神经网络;异常检测;智能体；防御技术 ABSTRACT Intrusion Detection System is a hot research field of information security issues. In the concept and types of intrusion detection system based on intrusion detection system that the current advantages and limitations. Neural networks, genetic algorithms, fuzzy logic, immune theory, machine learning, expert Introduced and analyzed the two kinds of intelligent methods based IDS, IDS proposed development in the future issues that need to improve. Defense technology is built on the inside and outside the network boundary filtering block mechanism, it considers the internal network is safe and reliableLai, while the external network is considered unsafe and unreliable 【Keywords】: IDS; Intrusion Detection Expert System; artificial neural networks; anomaly detection; agent; defense technology 目录 TOC \o 1-3 \h \z \u HYPERLINK \l _Toc260749472 摘 要 PAGEREF _Toc260749472 \h I HYPERLINK \l _Toc260749473 ABSTRACT PAGEREF _Toc260749473 \h II HYPERLINK \l _Toc260749474 目录 PAGEREF _Toc260749474 \h III HYPERLINK \l _Toc260749475 前 言 PAGEREF _Toc260749475 \h 1 HYPERLINK \l _Toc260749476 第一章 入侵检测检测的发展历程和定义 PAGEREF _Toc260749476 \h 2 HYPERLINK \l _Toc260749477 1.1 发展历程 PAGEREF _Toc260749477 \h 2 HYPERLINK \l _Toc260749478 1.2 入侵检测的定义 PAGEREF _Toc260749478 \h 2 HYPERLINK \l _Toc260749479 第二章 入侵检测的关键技术 PAGEREF _Toc260749479 \h 4 HYPERLINK \l _Toc260749480 2.1基于行为的入侵检测技术 PAGEREF _Toc260749480 \h 4 HYPERLINK \l _Toc260749481 2．2 基于知识的入侵检测技术 PAGEREF _Toc260749481 \h 4 HYPERLINK \l _Toc260749482 2．3基于其它方法的入侵检测技术 PAGEREF _Toc260749482 \h 4 HYPERLINK \l _Toc260749483 第三章 入侵检测系统模型、分类和IDS PAGEREF _Toc260749483 \h 5 HYPERLINK \l _Toc260749484 3.1 入侵检测系统模型