【作者】 贾存虎；

【导师】 徐德启；

【作者基本信息】 兰州大学 ， 计算机软件与理论， 2006， 硕士

【摘要】 入侵检测是计算机安全领域重要的动态安全技术,也是当前计算机安全理论研究的一个热点。 本文首先阐述了入侵检测的概念、研究现状和分类,比较了几种常见的入侵检测技术。在此基础上,提出了基于数据解析和特征信息序列语法分析的入侵检测技术,也可称为基于解析自动机和检测分析树的入侵检测技术。进而参照CIDF模型,设计了一个基于数据解析和特征信息序列语法分析技术的入侵检测系统模型。 基于解析自动机和检测分析树的入侵检测技术总体上属于滥用检测技术的范畴,同时具备一定的异常检测能力,因而兼备滥用检测和异常检测两类技术的优点,克服了两者的一些缺点。特别是,由于检测分析中所用模式的优点而大大提高检测效率。一方面,由于多个类型的入侵用一个文法模式描述,模式总量少,较好地克服了一般的模式匹配技术中因模式数量多而不可避免的匹配盲目性以及由此引起的低效率的问题;另一方面由于所用模式都是可以用受限左线性文法描述的,充分利用这种受限的左线性文法的特点,将检测分析程序设计成一个简化的LR(0)语法分析程序,因而也可大大提高检测分析的效率。更多还原

【Abstract】 Intrusion Detection, which is trying to detect intrusion attempts so that action may be taken to repair the damage later, is one of the important dynamic technology of computer security.The paper explains the conception and classification of IDS, and several important techniques of IDS usually used. After that, the paper introduces a new method of intrusion detection that based on data resolving and parsing for sequence of characteristic information, or technique of intrusion detection based on resolving FSM and parse tree. Then, an IDS model based on data resolving and parsing for sequence of characteristic information is designed in this paper.Intrusion detection based on data resolving and parsing for sequence of characteristic information is a kind of misuse ID which has some functions of anomaly ID, so it has advantages of both, and can avoid some disadvantages of both. Particularly, for the advantage of the patterns used in detection, the efficiency of detection can be improved greatly. On one hand, the quantity of the patterns is much less than that of other pattern recognition technology. This can avoid blindness of the matching. On the other hand, the pattern of any intrusion can be described by a restricted left liner grammar, and we can use the characteristic of the left liner grammar fully, so that the parser can be designed as an optimized one that can improve the efficiency of the parsing very much.更多还原