入侵檢測是網(wǎng)絡(luò)安全的一個(gè)新方向，其重點(diǎn)是有效地提取特征數(shù)據(jù)并準(zhǔn)確地分析出非正常網(wǎng)絡(luò)行為。該文在深入研究分析公共入侵檢測框架理論和現(xiàn)有入侵檢測系統(tǒng)實(shí)現(xiàn)策略的基礎(chǔ)上，提出一種基于部件的入侵檢測系統(tǒng)，具有良好的分布性能和可擴(kuò)展性。它將網(wǎng)絡(luò)和主機(jī)的入侵檢測系統(tǒng)有機(jī)地結(jié)合在一起，提供了集成化的檢測、報(bào)告和響應(yīng)功能。
關(guān) 鍵 詞 入侵檢測; 通用模型; 模式匹配; 事件

Abstract Intrusion Detection is a newly developed area of network security. The main issue in this area is how to pick-up and analyze the information which contains abnormal network behavior characteristic. In this paper, basing on the research of CIDF and the implement strategy of intrusion Detection System, we design a component-based Intrusion Detection System, which has good distribute and scalable ability. It combine the network-based IDS and host-based IDS into a system, and provide detection, report and respond together.
Key words instrusion detection; common instrusion detection frame; pattern match; event