The invasion examination (Intrusion Detection), as the name suggests, is to invades the behavior detecting. It through to the computer network or in computer system's certain key point collection information and to it carries on the analysis, discovered that network or system whether to have violates the security policy the behavior and the sign which attacks. Carries on the invasion examination the software and hardware's combination is invades the examination system (Intrusion Detection System, is called IDS).
Is different what with other security product, invasion examination systematic need more intelligences, it must be possible the data which obtains to carry on the analysis, and obtains the useful result. A qualified invasion examination system can the big simplified manager's work, the guarantee network security movement. Therefore, after the invasion examination is considered is firewall's second security strobe, in does not affect the network performance in the situation to be able to carry on the monitor to the network, thus provides to the internal attack, the exterior attack and misoperation's real-time protection. These carry out following task through it to realize:
· surveillance, analysis user and system activity;
· system structure and weakness audit;
· the recognition reflection known attack's active pattern and reports to the police to the related public figure;
· deviant behaviour pattern statistical analysis;
· appraisal important system and data file integrity;
· operating system's audit trail management, and distinguishes the user to violate the security policy the behavior.
Below, I from the invasion examination system's function, classified as well as invasion examination technology these three aspects, will come the system to carry on the simple introduction regarding this.
Invasion examination system's major function
As for a successful invasion examination system, not only it may cause the system manager time understanding network system (including procedure, document and hardware equipment and so on) any change, but can also give the cyber security policy the making to provide the guide. A more important spot is, it should manage, the disposition to be simple, thus causes the laymen to obtain the network security very easily. Moreover, the invasion examination's scale should also according to the network threat, the system structure and the security requirements change changes. Invasion examination system after discovery invasion, will make the response promptly, including cut-off network connections, record event and warning and so on. Specifically speaking, the invasion examination system's major function includes:
· monitors and analyzes the user and system's activity;
· verification system disposition and crack;
· appraisal system essential resources and data file integrity;
· recognition known aggressive behavior;
· statistical analysis deviant behaviour;
Other pages: : 1 * 2 * 3 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination