【摘要】 目前绝大部分异常检测方法只利用数据包的头部信息来检测网络攻击,即仅仅从网络层、传输层来分析网络的异常情况。而研究表明现在的网络攻击主要发生在应用层,因此从应用层来分析网络异常的研究就显得十分重要。首先介绍了入侵检测和异常检测的研究现状,突出强调了应用层异常检测的重要性,接着详细介绍了目前几种主要的应用层异常检测方法,最后讨论了应用层异常检测所面临的挑战。更多还原

【Abstract】 Most of the network anomaly detection approaches are based on packet header fields,while the payload is usually discarded,namely they detect network attacks only from network layer and transport layer.Unfortunately,most of today’s attacks happen on the application level,so the research of the application level anomaly detection is very important.We first introduced the current status of intrusion detection and network anomaly detection,and emphasized the importance of the application level anomaly detection.Then we introduced the main approaches of the application level anomaly detection in detail.Finally we discussed the challenges of the application level anomaly detection.更多还原