鍏ヤ镜妫�娴嬫妧鏈患杩?/p>
鑳″緛鍏?/p>
1
Shirochin V.P.
2
涔屽厠鍏板浗绔嬬鎶�澶у
鎽樿
Internet
钃媰鍙戝睍鍒颁粖澶╋紝璁＄畻鏈虹郴缁熷凡缁忎粠鐙珛鐨勪富鏈哄彂灞曞埌澶嶆潅銆佷簰杩炵殑寮�鏀惧紡绯荤粺锛岃繖缁欎汉浠湪
淇℃伅鍒╃敤鍜岃祫婧愬叡浜笂甯︽潵浜嗗緢澶х殑渚垮埄銆傜敱
Internet
鏉ヤ紶閫掑拰澶勭悊鍚勭鐢熸椿淇℃伅锛屾棭宸叉垚涓轰汉浠噸瑕佺殑娌熼�氭柟寮?/p>
涔嬩竴锛岄殢涔嬭�屾潵鐨勫悇绉嶆敾鍑讳簨浠朵笌鍏ヤ镜鎵嬫硶鏇存槸灞傚嚭涓嶇┓锛屽紩鍙戜簡涓�绯诲垪瀹夊叏闂銆傛湰鏂囦粙缁嶇幇浠婄儹闂ㄧ殑缃戠粶瀹夊叏鎶�
鏈?/p>
-
鍏ヤ镜妫�娴嬫妧鏈紝鏈枃鍏堣杩板叆渚垫娴嬬殑姒傚康銆佹ā鍨嬪強鍒嗙被锛屽苟鍒嗘瀽浜嗗叾妫�娴嬫柟娉曞拰涓嶈冻涔嬪锛屾渶鍚庤鎻忚堪浜嗗畠鐨?/p>
鍙戝睍瓒嬪娍鍙婁富瑕佺殑
IDS
鍏徃鍜屼骇鍝併�?/p>
鍏抽敭璇?/p>
鍏ヤ镜妫�娴?/p>
鍏ヤ镜妫�娴嬬郴缁?/p>
缃戠粶瀹夊叏
闃茬伀澧?/p>
1
寮曡█
闅忕潃涓汉銆佷紒涓氬拰鏀垮簻鏈烘瀯鏃ョ泭渚濊禆浜?/p>
Internet
杩涜閫氳锛屽崗浣滃強閿�鍞�傚瀹夊叏瑙ｅ喅鏂规鐨勯渶姹傛�ュ墽澧為暱銆傝繖
浜涘畨鍏ㄨВ鍐虫柟妗堝簲璇ヨ兘澶熼樆姝㈠叆渚佃�呭悓鏃跺張鑳戒繚璇佸鎴峰強鍚堜綔浼欎即鐨勫畨鍏ㄨ闂�?/p>
铏界劧闃茬伀澧欏強寮哄ぇ鐨勮韩浠介獙璇佽兘澶熶繚
鎶ょ郴缁熶笉鍙楁湭缁忔巿鏉冭闂殑渚垫壈锛?/p>
浣嗘槸瀹冧滑瀵逛笓涓氶粦瀹㈡垨鎭舵剰鐨勭粡鎺堟潈鐢ㄦ埛鍗存棤鑳戒负鍔涖�?/p>
浼佷笟缁忓父鍦ㄩ槻鐏绯荤粺涓婃姇
鍏ュぇ閲忕殑璧勯噾锛屽湪
Internet
鍏ュ彛澶勯儴缃查槻鐏绯荤粺鏉ヤ繚璇佸畨鍏紝
渚濊禆闃茬伀澧欏缓绔嬬綉缁滅殑缁勭粐寰�寰�鏄�滃绱у唴鏉锯�濓紝
鏃犳硶闃绘鍐呴儴浜哄憳鎵�鍋氱殑鏀诲嚮
,
瀵逛俊鎭祦鐨勬帶鍒剁己涔忕伒娲绘�э紝浠庡闈㈢湅浼奸潪甯稿畨鍏紝浣嗗唴閮ㄧ己涔忓繀瑕佺殑瀹夊叏鎺柦銆傛嵁
缁熻锛屽叏鐞?/p>
80%
浠ヤ笂鐨勫叆渚垫潵鑷簬鍐呴儴銆傜敱浜庢�ц兘鐨勯檺鍒讹紝闃茬伀澧欓�氬父涓嶈兘鎻愪緵瀹炴椂鐨勫叆渚垫娴嬭兘鍔涳紝瀵逛簬浼佷笟鍐呴儴
浜哄憳鎵�鍋氱殑鏀诲嚮锛岄槻鐏褰㈠悓铏氳銆?/p>
鍏ヤ镜妫�娴嬫槸瀵归槻鐏鍙婂叾鏈夌泭鐨勮ˉ鍏咃紝鍏ヤ镜妫�娴嬬郴缁熻兘浣垮湪鍏ヤ镜鏀诲嚮瀵圭郴缁熷彂鐢熷嵄瀹冲墠锛屾娴嬪埌鍏ヤ镜鏀诲嚮锛屽苟鍒?/p>
鐢ㄦ姤璀︿笌闃叉姢绯荤粺椹遍�愬叆渚垫敾鍑汇�傚湪鍏ヤ镜鏀诲嚮杩囩▼涓紝鑳藉噺灏戝叆渚垫敾鍑绘墍閫犳垚鐨勬崯澶便�傚湪琚叆渚垫敾鍑诲悗锛屾敹闆嗗叆渚垫敾
鍑荤殑鐩稿叧淇℃伅锛屼綔涓洪槻鑼冪郴缁熺殑鐭ヨ瘑锛屾坊鍔犲叆鐭ヨ瘑搴撳唴锛屽寮虹郴缁熺殑闃茶寖鑳藉姏锛岄伩鍏嶇郴缁熷啀娆″彈鍒板叆渚点�傚叆渚垫娴嬭
璁や负鏄槻鐏涔嬪悗鐨勭浜岄亾瀹夊叏闂搁棬锛屽湪涓嶅奖鍝嶇綉缁滄�ц兘鐨勬儏鍐典笅鑳藉缃戠粶杩涜鐩戝惉锛屼粠鑰屾彁渚涘鍐呴儴鏀诲嚮銆佸閮ㄦ敾
鍑诲拰璇搷浣滅殑瀹炴椂淇濇姢
,
澶уぇ鎻愰珮浜嗙綉缁滅殑瀹夊叏鎬?/p>
[1]
銆?/p>
2
鍏ヤ镜妫�娴嬬殑姒傚康銆佹ā鍨?/p>
鍏ヤ镜妫�娴嬶紙
Intrusion Detection
锛?/p>
ID
锛?/p>
,
椤惧悕鎬濅箟锛屾槸瀵瑰叆渚佃涓虹殑妫�娴嬨�傚畠閫氳繃鏀堕泦鍜屽垎鏋愯绠楁満缃戠粶鎴栬
绠楁満绯荤粺涓嫢骞插叧閿偣鐨勪俊鎭紝
妫�鏌ョ綉缁滄垨绯荤粺涓槸鍚﹀瓨鍦ㄨ繚鍙嶅畨鍏ㄧ瓥鐣ョ殑琛屼负鍜岃鏀诲嚮鐨勮抗璞°�?/p>
杩涜鍏ヤ镜妫�娴嬬殑杞?/p>
浠朵笌纭欢鐨勭粍鍚堜究鏄叆渚垫娴嬬郴缁燂紙
Intrusion Detection System,IDS
锛夈�?/p>
鍏ヤ镜妫�娴嬬殑鐮旂┒鏈�鏃╁彲浠ヨ拷婧埌瑭瑰鏂峰畨寰锋．
[1]
鍦?/p>
1980
骞翠负缇庡浗绌哄啗鍋氱殑棰樹负銆婅绠楁満瀹夊叏濞佽儊鐩戞帶涓庣洃
瑙嗐�嬬殑鎶�鏈姤鍛婏紝绗竴娆¤缁嗛槓杩颁簡鍏ヤ镜妫�娴嬬殑姒傚康銆備粬鎻愬嚭浜嗕竴绉嶅璁＄畻鏈虹郴缁熼闄╁拰濞佽儊鐨勫垎绫绘柟娉曪紝骞跺皢濞佽儊
鍒嗕负澶栭儴娓楅�忋�佸唴閮ㄦ笚閫忓拰涓嶆硶琛屼负涓夌锛岃繕鎻愬嚭浜嗗埄鐢ㄥ璁¤窡韪暟鎹洃瑙嗗叆渚垫椿鍔ㄧ殑鎬濇兂銆備粬鐨勭悊璁烘垚涓哄叆渚垫娴?/p>
绯荤粺璁捐鍙婂紑鍙戠殑鍩虹
,
浠栫殑宸ヤ綔鎴愪负鍩轰簬涓绘満鐨勫叆渚垫娴嬬郴缁熷拰鍏跺畠鍏ヤ镜妫�娴嬬郴缁熺殑鍑哄彂鐐广�?/p>
Denning[2]
鍦?/p>
1987
骞存墍鍙戣〃鐨勮鏂囦腑锛岄鍏堝鍏ヤ镜妫�娴嬬郴缁熸ā寮忓仛鍑哄畾涔夛細涓�鑸�岃█锛屽叆渚垫娴嬮�氳繃缃戠粶灏佸寘
鎴栦俊鎭殑鏀堕泦锛?/p>
妫�娴嬪彲鑳界殑鍏ヤ镜琛屼负锛?/p>
骞朵笖鑳藉湪鍏ヤ镜琛屼负閫犳垚鍗卞鍓嶅強鏃跺彂鍑烘姤璀﹂�氱煡绯荤粺绠＄悊鍛樺苟杩涜鐩稿叧鐨勫鐞?/p>
鎺柦銆備负浜嗚揪鎴愯繖涓洰鐨勶紝鍏ヤ镜妫�娴嬬郴缁熷簲鍖呭惈
3
涓繀瑕佸姛鑳界殑缁勪欢锛氫俊鎭潵婧愩�佸垎鏋愬紩鎿庡拰鍝嶅簲缁勪欢銆?/p>
鈼忎俊鎭潵婧愶紙
Information Source
锛夛細涓烘娴嬪彲鑳界殑鎭舵剰鏀诲嚮锛?/p>
IDS
鎵�妫�娴嬬殑缃戠粶鎴栫郴缁熷繀椤昏兘鎻愪緵瓒冲鐨勪俊鎭?/p>
缁?/p>
IDS
锛岃祫鏂欐潵婧愭敹闆嗘ā缁勭殑浠诲姟灏辨槸瑕佹敹闆嗚繖浜涗俊鎭綔涓?/p>
IDS
鍒嗘瀽寮曟搸鐨勮祫鏂欒緭鍏ャ�?/p>
鈼忓垎鏋愬紩鎿庯紙
Analysis Engine
锛夛細鍒╃敤缁熻鎴栬鍒欑殑鏂瑰紡鎵惧嚭鍙兘鐨勫叆渚佃涓哄苟灏嗕簨浠舵彁渚涚粰鍝嶅簲缁勪欢銆?/p>
鈼忓搷搴旀ā缁勶紙
Response
Component
锛夛細鑳藉鏍规嵁鍒嗘瀽寮曟搸鐨勮緭鍑烘潵閲囧彇搴旀湁鐨勮鍔ㄣ�傞�氬父鍏锋湁鑷姩鍖栨満鍒讹紝濡備富
鍔ㄩ�氱煡绯荤粺绠＄悊鍛樸�佷腑鏂叆渚佃�呯殑杩炴帴鍜屾敹闆嗗叆渚典俊鎭瓑銆?/p>
3
鍏ヤ镜妫�娴嬬郴缁熺殑鍒嗙被
鍏ヤ镜妫�娴嬬郴缁熶緷鐓т俊鎭潵婧愭敹闆嗘柟寮忕殑涓嶅悓锛?/p>
鍙互鍒嗕负鍩轰簬涓绘満
锛?/p>
Host-Based
IDS
锛?/p>
鐨勫拰鍩轰簬缃戠粶
锛?/p>
Network-Based
IDS
锛夛紱鍙﹀鎸夊叾鍒嗘瀽鏂规硶鍙垎涓哄紓甯告娴嬶紙
Anomaly
Detection,AD
锛夊拰璇敤妫�娴嬶紙
Misuse
Detection,MD
锛夛紝鍏跺垎绫?/p>
鏋舵瀯濡傚浘
1
鎵�绀猴細
鍥?/p>
1.
鍏ヤ镜妫�娴嬬郴缁熷垎绫绘灦鏋勫浘
鍏ヤ镜妫�娴嬬郴缁燂紙
IDS
锛?/p>
缃戠粶鍨嬶紙
Network-Based
锛?/p>
璇敤妫�娴嬶紙
MD
锛?/p>
寮傚父妫�娴?/p>
(AD)
涓绘満鍨?/p>
(Host-based )