【摘要】 针对现有网络行为监控系统在监控力度和范围上的不足,文章提出了一种分布式网络行为监控系统(DNBM),本系统由监管中心和若干个主机监控端组成。监管中心集中制定分发策略,日志审计查看;主机监控端则实现主机网络行为监控。主机监控端采用三层过滤,从内容,到应用,再到底层数据包,实现了对网络行为更为全面的监控;同时,采用对远程线程插入和注册表写操作的实时监控,更好限制了恶意代码的激活与执行,大大提升了系统的安全性与可靠性。更多还原

【Abstract】 The behavior of the network is controlled to the security threat brought to the system that users surf the Net, This text has proposed the design plan of a kind of distributed network behavior monitoring system, and Relevant technology, give a three level filtering project, and the method of hooking the operation of writing register table and remote thread injection , Practice has proved that the monitoring system has improved PC system’s capability of anti Trojan and security.更多还原