数据采集与数据分析的协同问题

入侵者无论从规模与方法上入侵技术近年来都发生了变化.目前的入侵检测系统将网络数据包的采集、分析与日志文件的采集、分析割裂开来,而且将来的网络速度越来越快,许多重要的网络还是加密的.在这种情况下,对网络数据包这种动态数据的采集就显得更加困难了.因此,在数据采集和数据分析上进行协同并充分利用各层次的数据,是提高入侵检测能力的首要条件.

Cooperative problem of data acquisition and data analysis

Intruder has changed in intrusion technology when it is in scale or in way.The network data package acquisition and analysis are separated from log file acquisition and analysis in nowadays intrusion detective system.And network speed will run faster and faster,some important network is security.In this condition,it will be harder in sampling mobile data of network data package.So the key factor of improving intrusion detective capacity is the cooperative work of data acquisition and data analysis and taking full advantage of all layers' data.