| 摘要: |
| DIDAPPER(distributedintrusiondetectorwithapperception)系统是一种具有认知能力的分布式入侵检测系统.分布式结构、认知能力和知识的共享是该系统的重要特点.重点讨论了DIDAPPER系统的认知能力.流量标本和IP陷阱是DIDAPPER系统所提出的新概念.它们可以获取和识别异常的流量数据,而且适合于检测大规模网络攻击行为.DIDAPPER系统的认知能力的另一个方面是神经网络的模式识别方法.将具有自学习能力的BP网络应用于流量分析,很好地解决了流量模式的识别问题. |
| 关键词: 入侵检测系统(IDS) 大规模自动攻击 流量标本 IP陷阱 模式识别 神经网络 BP网络 |
| DOI： |
| 分类号: |
| 基金项目:国家863高科技发展计划资助项目(863-317-01-99) |
|
| A Distributed Intrusion Detection System and Its Apperception Ability |
|
CHEN Shuo,AN Chang-qing,LI Xue-nong
|
| Abstract: |
| The DIDAPPER (distributed intrusion detector with apperception) system presented in this paper is a distributed intrusion detector with apperception. The distributed architecture, the apperception ability and the sharing of knowledge are evident characteristics of the DIDAPPER. This paper focuses on the apperception ability of DIDAPPER. Traffic specimens and IP traps are DIDAPPER's new concepts, which can capture and recognize abnormal traffics and are suitable for monitoring the large scale network attacks. The other aspect of DIDAPPER's apperception ability comes from the neural network algorithm. The BP neural network with learning ability has been applied to traffic analysis, and shows good effect on the recognition of traffic patterns. |
| Key words: IDS (intrusion detection system) large-scale automatic attack traffic specimen IP trap pattern recognition neural network, BP network |
