基于主机日志的入侵检测技术分析-通信与信息系统专业论文.docxVIP

华中科技 大学硕士 学 华 中 科 技 大 学 硕 士 学 位 论 文 II II Abstract The development of information technology changes with each passing day since the computer appeared and the information times based on network advents. More and more people do business activities through Internet, but because of the Internets opening and the network systems frangibility the security extrudes out. How to construct safe network environment gains more and more attention. Intrusion detection is one of the core technologies of the network security. It is a more new issue in this domain, the core of the dynamic security domain. There are many problems in this field such as the intrusion detection system with adaptive and self-learning ability is not perfect. To solve these questions, first introduce the research background , the status of intrusion detection system, the definition, function, foreground, limitation of intrusion detection technology and some concepts of data mining, especially the association rule analyzing method. Then design a new mainframe-based intrusion detection system. This structure uses data mining algorithm and combine the misapplication detection and abnormity detection. It is suitable for detecting deferent data sources and use anew log conversion. Keywords : Intrusion Detection, host, information security, data mining, rule base PAGE 1 PAGE 1 目 录 摘 要 I HYPERLINK \l _bookmark0 Abstract II 1 绪论 HYPERLINK \l _bookmark1 1.1 课题研究背景及意义 (1) HYPERLINK \l _bookmark2 1.2 入侵检测的发展及研究现状 (1) HYPERLINK \l _bookmark3 1.3 论文主要研究工作 (3) HYPERLINK \l _bookmark4 1.4 论文的组织结构 (3) 2 相关理论与技术 HYPERLINK \l _bookmark5 2.1 入侵检测技术 (5) HYPERLINK \l _bookmark6 2.2 数据挖掘技术 (10) HYPERLINK \l _bookmark7 2.3 基于主机日志的入侵检测 (13) HYPERLINK \l _bookmark8 2.4 本章小结 (14) HYPERLINK \l _bookmark9 3 主机日志收集与处理 HYPERLINK \l _bookmark10 3.1 日志的概念及其特点 (15) HYPERLINK \l _bookmark11 3.2 操作系统日志 (16) HYPERLINK \l _bookmark12 3.3 主机日志的采集 (20) HYPERLINK \l _bookmark13 3.4 主机日志的处理与传输 (22) HYPERLINK \l _bookm