The attack technology and the method develop unceasingly urge network security product unceasingly renewals and so on IDS, causes the IDS product from a simple machine's product development into intellectualization product.
The invasion examination's research might trace JamesP.Anderson in 1980 work, he proposed for the first time “the threat” and so on terminology, here referred to “threat” with invasion meaning basic same, will invade the attempt or the threat definition will be: Latent, deliberate, the visit attempt without authorization, the cause system unreliable or is unable to use. in 1987 DorothyE. Denning gives an invasion examination for the first time the abstraction model, and will invade the examination to take a new safe defensive measure to propose. in 1988, the Morris worm event sped up to invades the examination system (IDS:Intrusion Detection System) the development research.
In the past's 20 years, the networking was developing unceasingly, the aggressor level was enhancing unceasingly, attacks the tool and the attack technique day by day complex diverse, day by day was specially prominent take the hacker as representative's aggressor to the network threat, they were sparing no effort to carry on with all security product are struggling. The attack technology and the method develop unceasingly urge network security product unceasingly renewals and so on IDS, causes IDS the product from a simple machine's product development into intellectualization product.
First, present IDS existence flaw
The invasion examination system takes the network security protection the important means that has many places to be worth our further deep research. Present IDS also has many problems, waits for further consummates in us.
1. Gao Wu police (misinformation) rate
Harms police's traditional definition is takes for malignantly the benign current capacity. On generalized says, harms the police also to include to the IDS user does not care about event's warning. Therefore, causes IDS product Gao Wu police's rate reason is the IDS examination precision is excessively low as well as the user to harms the police concept the development.
2. product adaptiveness is low
Traditional IDS product when development has not considered the specific network environment the demand, stereotyped. The networking in the development, the network equipment becomes complicates, the diversification, this needs to invade the examination product to be able the dynamic alignment, adapts the different environment demand.
3. large-scale network management question
Many enterprise sizes are expanding unceasingly, develops to the IDS product's deployment from the simple point to the cross region whole world deployed, this raises the company to product management's question the program. First, must guarantee that the new product architecture can support the hundreds of IDS sensor; Next, must be able to handle the warning event which the sensor produces; In addition, but must solve the attack characteristic storehouse establishment, the disposition as well as the renewal question.
Other pages: : 1 * 2 * 3 * 4 * 5 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination