黑客入侵检测与安全事故恢复

为能更有效地实现网络安全，提出并实现了一个集入侵检测、报警、事故恢复、黑客诱骗等功能于一体的多层主动防御体系——黑客监控系统。相比单纯的入侵检测系统，该系统既可实现对黑客的实时监控与诱捕，且能较好地实现容灾。入侵检测与安全事故恢复是黑客监控系统的2个关键部分，它们分别是监视黑客攻击和计算机被黑客攻击或被病毒感染后能使系统尽快恢复正常工作。使网络安全性提升到新的高度。

A New Multi-Function System to Deal with Hacker Intrusion

Our aim is to provide many functions in our new multi-function system for dealing with hacker intrusion. These functions include conventional detection and alert, non-conventional hacker deception and trapping, and restoration of damaged files. Our system is a multi-layer comprehensive active defense system, integrating real-time intrusion detection, alert, security accident restoration, and hacker deception.In the full paper, we explain in much detail how to implement the many functions in our new system. Here we give only a briefing. Compared with conventional IDS(Intrusion Detection System), our new system can not only monitor and trap hackers in real-time mode, but also can realize intrusion tolerance better . The detection function of our system can not only monitor hacker attack but also cleverly track the hacker until the hacker's true source is found. The restoration function of our system can restore important files which have been attacked by hacker or infected by virus.Our new system has been employed successfully on several networks; it can deal effectively with 31 categories of known hacker attacks, whose ways of attack number as many as 2 045.