| 摘要: |
| 详细介绍了在Linux环境下基于规则的分布式网络入侵检测系统NetNumen.同现有的网络入侵检测系统相比,NetNumen将异常检测(检测包到达频度的异常)和特征检测(检测特定攻击和攻击工具的固有特征)有机地结合起来,对DoS(denial of service),DdoS(distributed denial of service)攻击的检测效果较现有方法有明显的改善. |
| 关键词: 入侵检测 入侵检测系统 网络安全 DoS(denial of service) DdoS(distributed denial of service) |
| DOI： |
| 分类号: |
| 基金项目:国家863高科技发展计划资助项目(863-306-ZD08-01-2) |
|
| Design and Implementation of Distributed Intrusion Detection System NetNumen |
|
LI Wang,WU Li-fa,HU Gu-yu
|
| Abstract: |
| A rule-based distributed intrusion detection system NetNumen is presented in Linux in this paper. Compared with the existing network-based intrusion detection system, NetNumen combines anomaly detections (detecting the anomaly frequency of packets?arriving) with signature detections (detecting the immanent characters of specialized attack and attack instrument), which improves the detection effect of the attack of DoS (denial of service)and DdoS (distributed denial of service) dramatically. |
| Key words: intrusion detection IDS (intrusion detection system), network security DoS (denial of service) DdoS (distributed denial of service) |
