资源描述：
《信息安全(入侵检测)》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。
1、IntrusionDetectionSystemWhatisIDS?IDS=IntrusionDetectionSystemIntrusiondetectionsystems(IDSs)aresoftwareorhardwaresystemsthatautomatetheprocessofmonitoringtheeventsoccurringinacomputersystemornetwork,analyzingthemforsignsofsecurityproblems.NotfirewallWhyuseIDS?
2、Topreventproblembehaviors2.Todetectattacksandothersecurityviolationsthatarenotpreventedbyothersecuritymeasures3.Todocumenttheexistingthreattoanorganization, allowingimproveddiagnosis,recovery,andcorrection ofausativefactors.4.Toactasqualitycontrolforsecuritydes
3、ignand administrationGeneralIDSModelSensorAnalyzerManagerOperatorAdministratorBasicClassificationNIDS-NetworkBasede.g.CiscoSecureIDS,AxentNetpowler,Snort,ISSRealSecureNetworkSensor,NAICybercopMonitorHIDS-HostBasede.g.AxentIntruderAlert,ISSRealSecureOSSensor,Tri
4、pwireBasedondifferentdataresourceNIDS-NetworkBasedNIDSdetectattacksbycapturingandanalyzing networkpackets.Listeningonanetworksegmentorswitch,one network-basedIDScanmonitorthenetworktraffic affectingmultiplehoststhatareconnectedtothe networksegment,therebyprotec
5、tingthosehosts.monitoralargenetwork.littleimpactuponanexistingnetwork.·verysecureagainstattackandevenmadeinvisibleto manyattackers.AdvantagesofNetwork-BasedIDS·Network-basedIDSsmayhavedifficultyprocessinghigh traffic.·ManyofNIDSsdon’tapplytoswitch-basednetworks
6、.·Network-basedIDSscannotanalyzeencryptedinformation.·NIDSshaveproblemsdealingwithnetworkbased attacksthatinvolvefragmentingpackets.DisadvantagesofNetwork-BasedIDSs:Host-basedIDSsoperateoninformationcollected fromwithinanindividualcomputersystem.Host-BasedIDSsH
7、ost-basedIDSsnormallyutilizeoperatingsystem audittrails,andsystemlogsasinformationsourcesHIDScandirectlyaccessandmonitorthedatafilesandsystemprocesses,soanalyzeactivitieswithgreatreliabilityandprecision,Host-basedIDSscanoperateencryptednetworktrafficHost-basedI
8、DSsareunaffectedbyswitchednetworks.·WhenHost-basedIDSsoperateonOSaudittrails,they canhelpdetectTrojanHorseorotherattacksthat involvesoftwareintegritybreaches.AdvantagesHIDSa
