基于空间扩维特征的主机入侵检测模型

在基于访问控制粒度和多维安全拓扑空间的基础上分析了入侵攻击的特点,并提出基于空间扩维特征的入侵检测模型--SEDIDS. 为访问控制系统中的实体建立了语义网络模型,用语义网络完备性推理来检测访问控制实体的完整性,作为入侵攻击行为判断的依据,从而取代了依赖训练数据集建立系统访问模式轮廓进行比对的入侵检测传统手段.实验结果表明:该模型相对于传统的入侵检测具有较低的漏报率和误报率,并有较高的运行效率.

Spatial Expended-Dimension Character Based Host Intrusion Detection Model

We analyze the characteristic of intrusion attack based on access control granularity and multi-dimension secure topological space, and propose a spatial expended-dimension character based intrusion detection modeI--SEDIDS. We construct the semantic net model for the object of access control system, and detect the integrity of access control object by the complete reasoning on semantic net, which is used as the evidence of intrusion detection. The proposed model replaces the traditional method which only depends on the comparison of system access profile constructed by training dataset. The experimental results show that this model obtains low false positive rate and low false negative rate, and is of high efficiency.