基于网络引擎入侵检测系统的研究与实现

摘要

The detection model based on abuse and based on anomaly are two test models of IDS system,and the corresponding technologies are the network engine and the host agent. The host agency in this paper is based on anomaly model to realize intrusion detection. Comparing with intrusion character which stored in the database, it can determine whether it is an attack. So that it realizes a network engine can monitor the whole network with multiple hosts,and all components of the enterprise network can be secrued from attack by the network engine.%基于滥用和基于异常的检测模型是IDS系统两大检测模型,其对应的技术即为网络引擎和主机代理.本文主机代理采用基于异常的模型进行入侵检测,与数据库中存储的入侵特征库进行比较,从而判断是否是一次攻击,从而实现一个网络引擎可以监视具有多台主机的整个网段,通过网络引擎实现企业网络中所有组件不受攻击.