基于蜜罐的入侵检测系统的设计与实现*

传统的入侵检测系统无法识别未知的攻击,提出在入侵检测系统中引入蜜罐技术来弥补其不足,并设计和实现了一个基于人工神经网络的入侵检测系统HoneypotIDS。该系统应用感知器学习方法构建FDM检测模型和SDM检测模型两阶段检测模型来对入侵行为进行检测。其中,FDM检测模型用于划分正常类和攻击类,SDM检测模型则在此基础上对一些具体的攻击类型进行识别。最后,设计实验对HoneypotIDS的检测能力进行了测试。实验结果表明,HoneypotIDS对被监控网络中的入侵行为具有较好的检测率和较低的误报率。

Design and implementation of intrusion detection system based on honeypot

The traditional IDS (intrusion detection system) can not identify the unknown attacks. Therefore, this paper introduced honeypot technique into the IDS. It desigaed a intrusion detection system based on ANN (artificial neural network) . It constructed the system contained FDM detection model and SDM detection model by using perceptron learning method. FDM was used to distinguish the attack class from the normal class, while the other focused on detecting some main types of attacks. At last, an experiment was to test detection ability of HoneypotIDS. The results of the experiment show that HoneypotIDS has a better detection rate and a lower false positive rate for the intrusion activities in the monitored network.