ּȫӴ<br><br>IDSּϵͳĳٷչ֮صͬݱ䡣ҽһЩIDSһЩǷǳͨõģһЩЩƧIDSķٷչԼһЩIDS̵гӰͬĲܻ̿ͬһʾͬ壬ӶĳЩȷ˻ҡԴˣĻͼеﶼ&nbsp;<br><br>Alerts&nbsp;<br><br><br>һڷͼʱIDSϵͳһalertϢ֪ͨϵͳԱ̨IDSϵͳͬһ̨alertϢʾڼϣҲܰʾԶ̨̿ôalertͨIDSϵͳ÷ͨǼܵģSNMPЭ飬ͨܣemailSMSϢϼַĻϷʽݸԱ&nbsp;<br><br><br>Anomaly쳣&nbsp;<br><br><br>ĳ¼һ֪źƥʱIDS澯һanomaly쳣IDSṹһʱĴһ¼ʱIDSͻ澯ǰûʱ磬һûͻȻȡ˹ԱĿ¼ȨޡЩIDS̽˷ʽܣһʽIDSӦжϷиܡ&nbsp;<br><br><br>ApplianceIDSӲ&nbsp;<br><br><br>ЩҪװϵͳȥIDS⣬гĻϻһЩֳɵIDSӲֻ轫ǽоͿӦáһЩIDSӲCaptIOCisco&nbsp;Secure&nbsp;IDSOpenSnortDragonԼSecureNetPro&nbsp;<br><br><br>ArachNIDS&nbsp;<br><br><br>ArachNIDSMax&nbsp;Visiһݿ⣬Ƕ̬µģڶֻּϵͳURLhttp://www.whitehats.com/ids/&nbsp;<br><br><br>ARISAttack&nbsp;Registry&nbsp;&&nbsp;Intelligence&nbsp;Service¼עἰܷ&nbsp;<br><br><br>ARISSecurityFocus˾ṩһӷûʽӵInternetSecurityFocus簲ȫ¼SecurityFocusὫЩߵݽγϸ簲ȫͳƷԤ⣬ϡURLhttp://aris.securityfocus.com/&nbsp;<br><br><br>Attacks&nbsp;<br><br><br>AttacksΪͼ͸ϵͳƹϵͳİȫԣԻȡϢ޸ϢԼƻĿϵͳܵΪгIDSܹInternetͣ&nbsp;<br><br><br>񹥻1DOSDenial&nbsp;Of&nbsp;Service&nbsp;attackܾ񹥻DOSͨڿֶƻһϵͳİȫֻʹϵͳ̱ʹϵͳܾûṩͨfloodingľϵͳԴȵȡ&nbsp;<br><br><br>񹥻2DDOSDistributed&nbsp;Denial&nbsp;of&nbsp;Serviceֲʽܾ񹥻һ׼DOSʹôһһԶȴ޷㹻ϢﵽĽ˾ͲDDOSӶɢһĿ귢ľԶϵͳԴʹʧЧ&nbsp;<br><br><br>񹥻3SmurfһʽĹĿǰʱзʹùĿαװԴַһsmurfŴ㲥ִַpingȻлĿӦ𣬴Ӷжӡ10smurfŴĲοURhttp://www.powertech.no/smurf/&nbsp;<br><br><br>񹥻4TrojansľTrojanԴڹŴϣ˹ʹõľľвϣʿľ˵ʿӿľм𹥻ڼУԭָЩԺϷʽ֣ʵ˶ЩûкϷʱڲ֪£ͱװˡڶʽװĶԶ̿ƹߣTrojanܿݱΪרָ๤ߣBackOrificeSubSevenNetBusȵȡ&nbsp;<br><br><br>Automated&nbsp;ResponseԶӦ&nbsp;<br><br><br>˶ԹЩIDSԶЩʽкࣺܶȣͨ·ͷǽܾЩͬһַϢΣͨϷresetжӡַʽ⣬߿Էõ豸䷽ǣͨαװһѷĵַȻIDSͻ·ͷǽܾЩַʵϾǶԡԼˡܾˡresetķҪһӿڣڹ֮£һȵİ취ǣʹӿλڷǽڣʹרŵķ򣬴Ӷܿ׼IPջ&nbsp;<br><br><br>CERTComputer&nbsp;Emergency&nbsp;Response&nbsp;TeamӦӦС飩&nbsp;<br><br><br>ɵһ֧ӦӳСѡģ֧ŶӽCarnegie&nbsp;MellonѧǶԼȫ¼Ӧȡж֯CERTCNCERT/CCйӦЭģemergencyЩȷ֯Incidentȡ´Computer&nbsp;Incident&nbsp;Response&nbsp;TeamCIRT¼ӦŶӡresponseʱҲhandling棬京responseʾжǳڵо&nbsp;<br><br><br>CIDFCommon&nbsp;Intrusion&nbsp;Detection&nbsp;Frameworkּͨܣ&nbsp;<br><br><br>CIDFͼĳ̶ֳϽּ׼һЩЭӦóӿڣʹּоĿܹ֮ϢԴּҲܹϵͳáCIDFURLַhttp://www.isi.edu/gost/cidf/&nbsp;<br><br><br>CIRTComputer&nbsp;Incident&nbsp;Response&nbsp;Team¼ӦС飩&nbsp;<br><br><br>CIRTǴCERTݱģCIRT˶԰ȫ¼ѧʶϵĸı䡣CERTרضļģCIRTеincidentеincidentsһemergenciesеemergenciesԱincidents&nbsp;<br><br><br>CISLCommon&nbsp;Intrusion&nbsp;Specification&nbsp;Languageֹͨ淶ԣ&nbsp;<br><br><br>CISLCIDF˴ͨŵԡCIDFǶЭͽӿڱ׼ĳԣCISLǶּоԽб׼ĳԡ&nbsp;<br><br><br>CVECommon&nbsp;Vulnerabilities&nbsp;and&nbsp;Exposuresͨ©¶&nbsp;<br><br><br>©һɨӦԲʱͬĳ̶©ĳνҲȫͬУһЩ̻һ©ӦõǵIDSϵͳУ͸һִǵĲƷЧMITRECVE©ƽб׼ĳҲ˳°׼IDSƷCVEURLַhttp://cve.mitre.org/&nbsp;<br><br><br>Crafting&nbsp;PacketsԶݰ&nbsp;<br><br><br>ԶݰͿԱܿһЩù涨ݰṹӶݰƭʹյļ֪δԶݰһóNemesisURLַhttp://jeff.chi.wwti.com/nemesis/&nbsp;<br><br><br>DesynchronizationͬʧЧ&nbsp;<br><br><br>desynchronizationﱾָӱIDSķЩIDSܻõеԻ󣬴Ӷ޷¹ݡһ1998УѾʱˣЩ°desynchronizationָIDSӱܷ&nbsp;<br><br><br>Eleet&nbsp;<br><br><br>ڿͱд©ʱͨһǩǽһeliteeleetת֣31337ָǵʱelite=eleetʾӢ31337ͨһ˿ںŻкšĿǰеĴǡskillz&nbsp;<br><br><br>Enumerationо٣&nbsp;<br><br><br>оṤѧĹ󣬹߾ͻῪʼԴо١оָ̽һԷʲôԼЩԱáڵжǱģпܱȻΪ˱ⱻ⵽ǻᾡܵĽС&nbsp;<br><br><br>Evasionܣ&nbsp;<br><br><br>EvasionָһιֲIDSɹؼ⵽еžIDSֻһ棬ʵʹȴһĿ꣬νջɳ²֡EvasionһʽΪͬϢòͬTTLЧʱ䣩ֵIDSϢ޺ģ޺ϢλϵTTLҪĿҪTTLҪ̡һIDSӽĿ꣬޺Ĳ־ͻᱻֻʣкġ&nbsp;<br><br><br>Exploits©ã&nbsp;<br><br><br>ÿһ©ô©йĻơΪ˹ϵͳ߱д©ô̱&nbsp;<br><br><br>ÿ©©ִйķʽʽExploitΪ˹ϵͳڿͻд©ó&nbsp;<br><br><br>©ãZero&nbsp;Day&nbsp;Exploitʱ©ã&nbsp;<br><br><br>ʱ©ָδ˽е©ãҲ˵͵©õǰûб֡һһ©ñ簲ȫ緢֣ܿͻĲ򣬲IDSдʶϢʹ©ЧЧز&nbsp;<br><br><br>False&nbsp;Negatives©&nbsp;<br><br><br>©ָһ¼δIDS⵽򱻷ԱΪ޺ġ&nbsp;<br><br><br>False&nbsp;Positives󱨣&nbsp;<br><br><br>ָʵ޺¼ȴIDSΪ¼&nbsp;<br><br><br>Firewallsǽ&nbsp;<br><br><br>ǽ簲ȫĵһؿȻIDSǷǽ־ΪIDSṩϢǽԭǸݹ׼Դַ˿ڵȣΣ赲⡣&nbsp;<br><br><br>FIRSTForum&nbsp;of&nbsp;Incident&nbsp;Response&nbsp;and&nbsp;Security&nbsp;Teams¼ӦͰȫŶ̳&nbsp;<br><br><br>FIRSTɹ˽֯ϢЭӦжˣһһȵFIRSTܵ߶ȵӣURLַhttp://www.first.org/&nbsp;<br><br><br>FragmentationƬ&nbsp;<br><br><br>һϢ̫޷װأͲòֳƬϡƬMTUMaximum&nbsp;Transmission&nbsp;Units䵥Ԫ磬ƻtoken&nbsp;ringMTU4464̫EthernetMTU1500ˣһϢҪƻ䵽̫ҪѳһЩСƬϣȻĿĵؽȻЧʽͣǷƬЧǺܺõġڿͽƬΪIDSķ⻹һЩDOSҲʹ÷Ƭ&nbsp;<br><br><br>Heuristics&nbsp;<br><br><br>HeuristicsָּʹAIartificial&nbsp;intelligence˹ܣ˼롣ʹ۵IDSѾִԼ10ˣǻ߿ͨѵʹЩϢЩIDSʹ쳣ģʽȥ֣IDSҪϵѧϰʲô¼һЩΪѾ൱IDSˣԾͽǿʽIDSʵϣӦAIݽзIDSٺ١&nbsp;<br><br><br>Honeynet&nbsp;ProjectHoneyneṭ&nbsp;<br><br><br>HoneynetһѧϰߣһȫȱݵϵͳܵȫвʱϢͻᱻ񲢽ܷͿ˽ڿ͵һЩHoneynetһ30ȫרҵ֯Աɡר˽ڿʹõĹߡԺͶԼյ֪ʶĿѾһϵеhoneypotsṩ˿ܹHoneynet磬۲ֵЩϵͳеĺڿͣоڿ͵սΪ&nbsp;<br><br><br>Honeypot۹ޣ&nbsp;<br><br><br>۹һ©ϵͳģһܹڿṩһ׹Ŀꡣ۹ûҪɣӵĳԶӦΪǿɵġ۹޵һ;ӹ߶ĿĹù۹˷ʱ䡣ͬʱĹĿܵ˱мֵݽַ&nbsp;<br><br><br>۹Ŀ֮һΪ߶ڿѼ֤ݣ⿴СղĸоһЩУǲ۹ռ֤ߺڿ͵ġ&nbsp;<br><br><br>IDS&nbsp;CategoriesIDSࣩ&nbsp;<br><br><br>಻ͬ͵IDS·ֱг&nbsp;<br><br><br>IDS1Application&nbsp;IDSӦóIDSӦóIDSΪһЩӦóźţЩӦóָͨЩȽܹӦóWebݿȡԭڲϵͳĻIDSȻĬ״̬²Ӧó򣬵ҲԾѵӦӦó磬KSEһIDSԸ¼־ڽеһУ¼־йӦóݡӦóIDSһEnterceptWeb&nbsp;Server&nbsp;Edition&nbsp;<br><br><br>IDS2Consoles&nbsp;IDS̨IDSΪʹIDSЭֲͬʽIDSҪĿ̨ϢڵĿ̨ԽԴݣ̵IDSǽ·ȡЩϢۺһͿԳֳһĹͼЩ̨ԼĹӵĿ̨ṩԶ̹ܡIDSƷIntellitactics&nbsp;Network&nbsp;Security&nbsp;MonitorOpen&nbsp;Esecurity&nbsp;Platform&nbsp;<br><br><br>IDS3File&nbsp;Integrity&nbsp;CheckersļԼһϵͳܵߵвʱıĳЩؼļṩķʺԤ⡣ͨΪؼļϢժҪܵźţͿԶʱؼļ鿴Ƿ񱻸ı䣬ĳ̶ֳṩ˱֤һ⵽һ仯ԼͻᷢһңһϵͳѾܵϵͳԱҲʹͬķȷϵͳܵΣĳ̶ȡǰļ¼þּ֮ܽǡºֵƷļʵͬʱͽм飬ԿʵʱIDSƷˡƷTripwireIntact&nbsp;<br><br><br>IDS4Honeypots۹ޣ۹ޣǰѾܹ۹޵ӰMantrapSting&nbsp;<br><br><br>IDS5Host-based&nbsp;IDSIDSIDSԶԴϵͳ¼־мأֿɻIDSҲIDSʺڼЩڲԱԼѾܿ˴ͳļⷽ͸еĻ¼־ĶĹܣIDSԡ¼/־/ʱ䡱ǩƷлʽܡΪIDSʵʱģϵͳĴͿԺܿؼԱͰȫʿǳϲڣIDSָڷ/վ͵ּϵͳƷKane&nbsp;Secure&nbsp;EnterpriseDragon&nbsp;Squire&nbsp;<br><br><br>IDS6Hybrid&nbsp;IDSIDSִĽṹּһЩ⡣ȣĬ״̬µĽ粻ԻģʽʹͳIDSİװǳѡΣܸߵٶζźܶϢᱻNIDSHybrid&nbsp;IDSIDSǽЩһIDSһΣڵIDSHost&nbsp;IDSIDSȻֽ漫󣬵ͬʱҪǵɴľ޴ͷáֻΪǳؼķIDSЩ̰һIDSHybrid&nbsp;IDSʵֻΪ˹ЧӦIDSƷCentraxICERealSecure&nbsp;Server&nbsp;Sensor&nbsp;<br><br><br>IDS7Network&nbsp;IDSNIDSIDSNIDSͨмأԿɵ쳣ͰĻӦNIDSԭǴIDSĻϢ̽ǽǱøܻЭ鲢ά״̬NIDSڻӦóĲƷֻҪװϾͿӦáNIDSÿϢйķ߸£ҪЩϢIDSĲƷSecureNetProSnort&nbsp;<br><br><br>IDS8Network&nbsp;Node&nbsp;IDSNNIDSڵIDSЩIDSڸǲɿģװ֮ǻᶪܸ߱Ϣҽ羭IDSϴ͵ϢNNIDSNIDSĹίиӶ˸ٺͽ⡣ȻNNIDS˷ǽƣ֮仹𡣶ڱΪNNIDSĸ˷ǽӦöͼ磬˷ǽϷֵġͼӵ˿xxxһNNIDSκε̽ⶼ⣬NNIDSὫյ¼͵һĿ̨NNIDSƷBlackICE&nbsp;AgentTiny&nbsp;CMDS&nbsp;<br><br><br>IDS9Personal&nbsp;Firewall˷ǽ˷ǽװڵϵͳУֹܻӭӣǽĻǳȥģӶϵͳעⲻҪNNIDS˷ǽZoneAlarmSybergen&nbsp;<br><br><br>IDS10Target-Based&nbsp;IDSĿIDSǲȷIDSеһԲͬвͬ塣ܵһļԼһIDSѰҵֻǶЩܹܵеĹĿΪIDSٶȣΪѰЩҪĹ&nbsp;<br><br><br>IDWGIntrusion&nbsp;Detection&nbsp;Working&nbsp;Groupּ⹤飩&nbsp;<br><br><br>ּ⹤ĿǶݸʽͽϢĳ裬ЩϢǶּϵͳӦϵͳԼЩҪǽõĹϵͳҪ塣ּ⹤IETF֯Эͬ&nbsp;<br><br><br>IDWGURLַhttp://www.ietf.org/html.charters/idwg-charter.html&nbsp;<br><br><br>IETFURLַhttp://www.ietf.org/&nbsp;<br><br><br>Incident&nbsp;Handling¼&nbsp;<br><br><br>⵽һֻǿʼձǣ̨Ա᲻ϵյڸ޷ֳʱ׷ÿǱ¼ԱڸȤ¼־Ա¼ŶоķӦ֮󣬾Ҫ¼дҲ顢ۺ֮ˡ&nbsp;<br><br><br>Incident&nbsp;Response¼Ӧ&nbsp;<br><br><br>ԼǱ¼ӦЩ¼Ҫ¼ĳд&nbsp;<br><br><br>Islandingµ&nbsp;<br><br><br>µǰInternetȫжϣ⼸һˣûа취İ취һֻ֯ڴģĲܵǳԵİȫʱʹһֶΡ&nbsp;<br><br><br>Promiscuousģʽ&nbsp;<br><br><br>Ĭ״̬£IDSӿֻܿϢҲνnon-promiscuousǻģʽӿǻģʽͿԿеͨԴĿĵءIDSǱҪģͬʱܱϢ̽ͨHUBԽ⣬ܿȫͨĵطᶼԽspan˿ڡ&nbsp;<br><br><br>Routers·&nbsp;<br><br><br>·Ӳͬ࣬ǹOSI&nbsp;7ģ͵Ĵ㡣·ĻܾǽϢ䵽ǵĿĵءһЩ·зʿбACLsҪϢ˳ȥ·Խǵ־Ϣע뵽IDSϵͳУṩйر赲ķͼıϢ&nbsp;<br><br><br>Scannersɨ&nbsp;<br><br><br>ɨԶĹߣɨ©ּͬϵͳһҲΪ֣ܶ·ֱ&nbsp;<br><br><br>ɨ1Network&nbsp;ScannersɨɨҵеͳʹõICMP&nbsp;pingַױΪ˱ΣһЩ¼ackɨfinɨ衣ʹЩΪɨһôǣͬĲϵͳЩɨвͬķӦӶΪṩ˸мֵϢֹߵһnmap&nbsp;<br><br><br>ɨ2Network&nbsp;Vulnerability&nbsp;Scanners©ɨ©ɨɨǰչһܼĿͻһпΪڿõ©©ɨΪߺͰȫרʹãᾭIDSϵͳšƷRetinaCyberCop&nbsp;<br><br><br>ɨ3Host&nbsp;Vulnerability&nbsp;Scanners©ɨ๤߾ȨûڲɨǿȡȫԼļɵݡIDSرIDSԽƷSecurityExpressionsһԶWindows©ɨԶ޸©ISSݿɨɨݿе©&nbsp;<br><br><br>Script&nbsp;KiddiesűСӣ&nbsp;<br><br><br>ЩܵInternetȫƻ20002·ݶYahooľܾ񹥻һЩʮѧɵģǸЩµĿĺΪȫרͨЩ˳ΪűСӣScript&nbsp;KiddiesűСͨһЩԷġ̫crackerʹôInternet&nbsp;صϢűĿվƻڿ֯ʵʩȨЩűСʾΪͨдʱƻǵĿһΪ˸ǵӡ󡣽űСӾСǲҪõۣҲܹǹ֧ܳΪǿĵˡˣۺʱܵ͹ǵʵ&nbsp;<br><br><br>Shunningܣ&nbsp;<br><br><br>ָñ߽豸ԾܾвܻӭϢЩܾĳЩIPַϢ&nbsp;<br><br><br>Signatures&nbsp;<br><br><br>IDSĺǹʹIDS¼ʱϢ̻ᾭIDS󱨻IDSĹٶȡ˽IDSֵ֧ΪIDSûı׼еĲһ๥ЩὫЩгͻһӡ󣬺˸ǸõIDSһҪЩ&nbsp;<br><br><br>Stealthأ&nbsp;<br><br><br>ָIDSڼ⹥ʱΪǾDMZʹãûбǽЩȱ㣬ԶӦ