隐秘攻击与入侵检测的体系结构

入侵检测系统（IDS）是目前研究的一个热点，IDS从攻吉者的角度来看待系统安全，已经成为安全体系结构中不可缺少的一个环节，但是目前的IDS检测技术还不够成熟，存在一些方法使得攻击者可能绕开IDS的检测，文章探讨了一种所谓的隐秘攻击技术，这种方法用以攻击传统的基于关键字匹配的IDS，然后从如何检测隐秘攻击的角度出发讨论了IDS的安全体系结构。     

9种 IDS 入侵检测系统方法

入侵检测系统,英文简写为IDS,顾名思义,它是用来实时检测攻击行为以及报告攻击的。如果把防火墙比作守卫网络大门的门卫的话,那么入侵检测系统（IDS）就是可以主动寻找罪犯的巡警。因而寻求突破IDS的技术对漏洞扫描、脚本注入、URL攻击等有着非凡的意义,同时也是为了使IDS进一步趋向完善。     

安全事件关联分析引擎的研究与设计

入侵检测系统是动态安全防御里的重要环节，现有的入侵检测系统（IDS）存在一个致命的缺陷：误报率高居不下，IDS无法展现事件之间的逻辑关系，结果用户很难了解事件背后隐藏的攻击策略或逻辑步骤。为了解决IDS存在的上述问题，在深入分析入侵技术的基础上提出了基于入侵序列的启发式关联方法，设计并实现了一个事件关联分析引擎，最后验证了有效性。     

基于粒子群和人工免疫的混合入侵检测系统研究

目前,漏报率和误报率高一直是入侵检测系统（IDS）的主要问题,而IDS主要有误用型和异常型两种检测技术。根据这两种检测技术各自的优点以及它们的互补性,本文给出一种基于人工免疫的异常检测技术和基于粒子群优化（PSO）的误用检测技术相结合的IDS模型;同时,该系统还结合特征选择技术降低数据维度,提高系统检测性能。实验表明,该
系统具有较高的检测率和较低的误报率,可以自动更新规则库,并且记忆未知类型的攻击,是一种有效的检测方法。     

入侵检测系统

入侵检测系统（IDS）是一种基于主动策略的网络安全系统,是对常用的被动策略的逻辑补偿,是网络安全系统中的重要组成部分。首先对IDS技术进行了分析,说明了入侵检测的技术原理,并从两个角度对IDS进行分类;接着讨论了系统的实现方法和现有的IDS系统;最后总结了这项技术,展望了未来工作。     

免费的IDS你来用——入侵检测系统Snort

在当今社会互联网飞速发展的同时，入侵攻击、拒绝服务攻击等网络安全问题也随之而来，网络安全面临巨大的挑战。许多公司都开发出阻止和检测网络攻击的软、硬件。但是一套入侵检测系统（IDS）价值不菲，动则数万元，甚至数十万元，使得很多中小企业敬而远之。本文就向读者推荐一款高效稳定的，并且完全免费的入侵检测系统——Snort。很多系统管理员认为防火墙可以完成保护一个网络所需要的每一件事情。其实不然，防火墙守护在网络的边界，保护网络不受外部攻击。然而，一旦攻击者穿透（或者绕过）防火墙后，无论他在网络内部做了些什么，防火墙都无法发现。网络内部的攻击是隐藏在防火墙之后，因此为类攻击行为很难被发现，而此时就可以用到入侵检测系统（Intrusion detection System,IDS)了。如果说防火墙看做是一个国家的军队，保护边界不受侵犯、抵御外强，那IDS便是国家的警察，保护国内的安全，维护内部的稳定。     

入侵检测系统研究现状及发展趋势

入侵检测系统（IDS）可以对系统或网络资源进行实时检测,及时发现闯入系统或网络的入侵者,也可预防合法用户对资源的误操作,它是PDR（Protection Detection Response)安全模型的一个重要组成部分,本文主要从攻击检测方法,国内外研究状况等方面总结了入侵检测技术的研究现状,并结合自己的研究成果,提出了发展趋势及主要研究究方向。     

IDS和IPS的比较

1引言 由于现在有了因特网,网络安保已经成了工业企业最关注的话题。入侵检测系统（IDS）用于检测那些不需要对工业自动化控制系统（IACS）访问和操作,特别是通过网络。它是一种专用工具,知道如何分析和解释网络流量和主机活动。IDS的主要目标是对IACS网络检测入侵和入侵企图,让网络管理员采取适当的缓解和补救措施。IDS不会阻止这些攻击,但会让用户知道什么时候发生了攻击。     

基于DFFA模型的入侵检测系统研究

入侵检测系统IDS（Intrusion Detection System）是继传统安全保护措施后新一代的安全保障技术，但目前许多研究者仅局限于自动入侵检测相关技术的研究，很少关注IDS本身的安全。本文对IDS存在的脆弱点进行了分类，在深入分析目前国内外在IDS防护方面所做的相关工作的基础上，引入双功能前向转发（DFFA，Dual Functionality Forward Ahead）模型来提高IDS的健壮性。     

一种基于移动Agent的抗攻击性IDS模型

随着入侵检测系统(Inhusion Detection System——IDS)性能的逐步提高，攻击者往往在入侵目标网络之前攻击IDS，使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上，提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的IDS模型，并指出了将当前的分布式IDS转换成此模型的配置方法。     

A hybrid intrusion detection system design for computer network security

Intrusions detection systems (IDSs) are systems that try to detect attacks as they occur or after the attacks took place. IDSs collect network traffic information from some point on the network or computer system and then use this information to secure the network. Intrusion detection systems can be misuse-detection or anomaly detection based. Misuse-detection based IDSs can only detect known attacks whereas anomaly detection based IDSs can also detect new attacks by using heuristic methods. In this paper we propose a hybrid IDS by combining the two approaches in one system. The hybrid IDS is obtained by combining packet header anomaly detection (PHAD) and network traffic anomaly detection (NETAD) which are anomaly-based IDSs with the misuse-based IDS Snort which is an open-source project.The hybrid IDS obtained is evaluated using the MIT Lincoln Laboratories network traffic data (IDEVAL) as a testbed. Evaluation compares the number of attacks detected by misuse-based IDS on its own, with the hybrid IDS obtained combining anomaly-based and misuse-based IDSs and shows that the hybrid IDS is a more powerful system.     

Optimizing the Scalability of Network Intrusion Detection Systems Using Mobile Agents

Modern Intrusion Detection Systems (IDSs) are distributed real-time systems that detect unauthorized use or attacks upon an organization's network and/or hosts. The components of most distributed IDSs are arranged in a hierarchical tree structure, where the sensor nodes pass information to the analyzer nodes. Optimal placement of the analyzer nodes results in an improved response time for the IDS, and isolation of attacks within the IDS network. Since the network topology and workload are constantly changing, we are able to maintain near-optimal placement of the analyzer nodes by instantiating them as mobile agents. The analyzer nodes may then relocate, reproduce or be deleted as necessary. Such flexibility improves the response times and the stability of an IDS. The movement of the analyzer nodes also offers some protection against denial-of-service attacks, since secure analyzer nodes will be relocated to take over some of the functionality of the host under attack.     

一种基于数据挖掘技术的入侵检测模型研究

入侵检测系统是一种检测网络入侵行为并能够主动保护自己免受攻击的一种网络安全技术,是网络防火墙的合理补充。文中分析了入侵检测系统的通用模型,介绍了入侵检测系统的分类,给出了传统的网络检测技术,在此基础上,详细讨论了数据挖掘技术及其在入侵检测系统中的应用,提出了一个基于数据挖掘技术的入侵检测模型,该模型采用了数据挖掘中的分类算法和关联规则。经过实际测试,该模型能够使网络入侵检测更加自动化,提高检测效率和准确度。     

ContractGuard：面向以太坊区块链智能合约的入侵检测系统

以太坊智能合约本质上是一种在网络上由相互间没有信任关系的节点共同执行的已被双方认证程序。目前,大量的智能合约被用于管理数字资产,使智能合约成为黑客的重要攻击对象。常见的攻击方法是通过利用智能合约的漏洞来实现特定操作的入侵攻击。ContractGuard 是首次提出面向以太坊区块链智能合约的入侵检测系统,它能检测智能合约的潜在攻击行为。ContractGuard 的入侵检测主要依赖检测潜在攻击可能引发的异常控制流来实现。由于智能合约运行在去中心化的环境以及在高度受限的环境中运行,现有的IDS技术或者工具等以外部拦截形式的部署架构不适合于以太坊智能合约。为了解决这些问题,通过设计一个嵌入式的架构,实现了把 ContractGuard 直接嵌入智能合约的执行代码中,作为智能合约的一部分。在运行时刻,ContractGuard通过相应的context-tagged无环路径来实现入侵检测,从而保护智能合约。由于嵌入了额外的代码,ContractGuard一定程度上会增加智能合约的部署开销与运行开销,为了降低这两方面的开销,基于以太坊智能合约的特性对 ContractGuard 进行优化。实验结果显示,可有效地检测 83%的异常行为,其部署开销仅增加了36.14%,运行开销仅增加了28.17%。     

MDCI:一个分布式检测DDoS攻击的方法

鉴于DDoS攻击分布式、汇聚性的特点，实现分布在大规模网络环境中的多个IDS系统间合作检测有助于在攻击流形成规模前合成攻击全貌并适当反应．MDCI系统首次提出了环形合作模式，即构建一个环重要网络信息资源的IDS系统合作组，通过组内节点同信息共享和警报关联分析，迅速判定DDoS攻击、MDCI系统中，采用报头内容分析和反向散射分析相结合的方法对本地捕获的数据报进行分析并采用统一标准格式对可疑特征进行报警；采用数据流分类概率评估的方法实现合作结点间警报信息的关联分析，从而合成攻击的全貌．通过实验可以看到，该系统有效地提高了针对DDoS攻击的预警速度．     

Prevention of selective black hole attacks on mobile ad hoc networks through intrusion detection systems

A black hole attack on a MANET refers to an attack by a malicious node, which forcibly acquires the route from a source to a destination by the falsification of sequence number and hop count of the routing message. A selective black hole is a node that can optionally and alternately perform a black hole attack or perform as a normal node. In this paper, several IDS (intrusion detection system) nodes are deployed in MANETs in order to detect and prevent selective black hole attacks. The IDS nodes must be set in sniff mode in order to perform the so-called ABM (Anti-Blackhole Mechanism) function, which is mainly used to estimate a suspicious value of a node according to the abnormal difference between the routing messages transmitted from the node. When a suspicious value exceeds a threshold, an IDS nearby will broadcast a block message, informing all nodes on the network, asking them to cooperatively isolate the malicious node. This study employs ns2 to validate the effect of the proposed IDS deployment, as IDS nodes can rapidly block a malicious node, without false positives, if a proper threshold is set.     

A neuro-genetic based short-term forecasting framework for network intrusion prediction system

Information systems are one of the most rapidly changing and vulnerable systems, where security is a major issue. The number of security-breaking attempts originating inside organizations is increasing steadily. Attacks made in this way, usually done by ＂authorized＂ users of the system, cannot be immediately traced. Because the idea of filtering the traffic at the entrance door, by using firewalls and the like, is not completely successful, the use of intrusion detection systems should be considered to increase the defense capacity of an information system. An intrusion detection system （IDS） is usually working in a dynamically changing environment, which forces continuous tuning of the intrusion detection model, in order to maintain sufficient performance. The manual tuning process required by current IDS depends on the system operators in working out the tuning solution and in integrating it into the detection model. Furthermore, an extensive effort is required to tackle the newly evolving attacks and a deep study is necessary to categorize it into the respective classes. To reduce this dependence, an automatically evolving anomaly IDS using neuro-genetic algorithm is presented. The proposed system automatically tunes the detection model on the fly according to the feedback provided by the system operator when false predictions are encountered. The system has been evaluated using the Knowledge Discovery in Databases Conference （KDD 2009） intrusion detection dataset. Genetic paradigm is employed to choose the predominant features, which reveal the occurrence of intrusions. The neuro-genetic IDS （NGIDS） involves calculation of weightage value for each of the categorical attributes so that data of uniform representation can be processed by the neuro-genetic algorithm. In this system unauthorized invasion of a user are identified and newer types of attacks are sensed and classified respectively by the neuro-genetic algorithm. The experimental results obtained in this work show that the system achieves improvement in terms of misclassification cost when compared with conventional IDS. The results of the experiments show that this system can be deployed based on a real network or database environment for effective prediction of both normal attacks and new attacks.     

Mixing Wheat with the Chaff: Creating Useful Test Data for IDS Evaluation

As the use of intrusion detection systems (IDSs) continues to climb and as researchers find more ways to detect attacks amid a vast ocean of data. The problem of testing IDS solutions has reared its ugly bead. Showing that one technique is better than another or training an IDS about normal usage requires test data. As it turns out, collecting or creating such a data set is something of a catch-22. If the data already contains attacks, researchers will train the IDS to see the attacks as normal; the IDS could then fail to register them as malicious events in the future. The most efficient way, however, to determine whether a large data set contains malicious events is to scan it with existing IDS. Thus, any attacks that the existing IDS fails to find are presented to the new IDS as normal data leading to potential false negatives. Clearly, breaking this cycle requires an independent source of verifiable attack-free training data with which to train IDSs.     

一种基于移动代理的分布式IDS模型研究

传统的分布式层次型入侵检测系统也有难以克服的缺陷,在层出不穷的攻击方式面前容易崩溃。本文提出了一种基于移动代理的IDS模型,它综合了两个领域的研究成果：分布式IDS和移动代理(MA)。通过安全分析表明,该模型提供了较好的安全构架。