入侵检测系统研究进展

信息安全是人们高度关注的问题,我国信息安全与网络的防护能力尚处于发展的初级阶段.回顾了入侵检测系统的起源及其发展过程.在阐述入侵检测基本概念和类型的基础上,指出了目前各种入侵检测系统的优点和局限性.数据挖掘技术是克服目前入侵检测系统局限性的一种有效方法.介绍了数据挖掘的概念,并提出了一种基于数据挖掘的入侵检测系统框架.蜜罐系统和蜜网系统也是当前研究的热点问题,对其进行了分析,给出了应用实例.最后指出了下一步研究应该努力的方向.

Review of researches on intrusion detection system

Information security is an important topic which attracts extensive attention,but the research on information security and network defending is still in its primary stage in our country.The origin and development of Intrusion Detection System(IDS) are reviewed.The basic concepts,architecture and category of IDS are introduced,the advantages and limitations of each type of IDS are pointed out respectively.Data Mining technology is an effective method for overcoming the limitation of current IDS.The concept of Data Mining is introduced,an essential frame of IDS is proposed based on Data Mining technology.As hot topics in current research,Honeypot system and Honeynet system were also analyzed.Several application examples were presented.In the end,The direction of future research on IDS was pointed out.