【摘要】 介绍了蜜罐与入侵检测协作系统的设计模型。实现协作的方法是用无监督聚类对蜜罐系统中记录的数据进行分类,标记类别,再用决策树提取出入侵规则,最后把提取出的新入侵规则添加到入侵检测系统的规则库中。目的是使入侵检测系统可以检测出新入侵行为。仿真实验验证了模型的有效性。更多还原

【Abstract】 A model of the cooperation system of honeypot and IDS is introduced.The way of implementing the cooperation is:first,dividing the data from honeypot into several classes by using the unsupervised clustering;second,labeling it;and then extracting rules from the labeled data by decision tree;at last,adding new attack rules to the IDS rule-lib.The purpose is that IDS can detect the new attacks.This model’s effectiveness has been confirmed by the simulated experiment.更多还原