【摘要】 入侵检测系统一般只对入侵行为所引起的事件或系统特征进行分析,而往往忽略了入侵事件间的关联特征,以及入侵事件和系统状态间的联系。文章将ECA规则引入到入侵检测系统中,同时对系统动态特性和静态特性进行了分析,从而提高入侵检测的能力。更多还原

【Abstract】 Currently, the intrusion detection system only analyzes system signature or events resulted by intrusion behavior. But it ignores theconjunction among intrusion events and the relation between intrusion event and system state. The ECA rules are applied to IDS in this paper. Whendynamic characteristic and static characteristic are analyzed at the same time, the capability of IDS is greatly improved.更多还原