基于操作的多层次主机入侵检测模型与方法

提出了一个多层次的基于用户操作的入侵检测模型，并实现了其原型系统，在此模型中，检测系统从4个层次监测用户在被保护计算机系统上进行的操作，监测结果经过信息融合得到最终的入侵判断，该模型能够更容易地发现用户的异常行为，同时有效降低误报。结合原型实现还讨论了在各层次进行了侵检测的方法。

A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

In this paper we present a multi-layer and defense-in-depth intrusion detection model for networked computer systems with a prototype. In this model, the operations on the protected computer system are monitored by four sensors from different viewpoints. The final judgement is made by combining the results of the individual sensors using information fusion techniques. It is demonstrated that an anomaly behavior can be more easily discovered and false alarms can be effectively reduced using our detection model. The methods to detect intrusions at different layers are also discussed using the experience gained in prototype realization.