CAJ | 학술논문

传统的网络入侵检测系统已经不能满足如今人们对网络安全的要求。基于网络协议分析，提出一种内部规则和外部规则相结合的改进的系统设计。在外部规则中，设计一种新的特征描述语言，类似传统的编程语言，易懂且功能强大。通过内部规则的引入，将协议分析检测中的逻辑进行丰富，实现对复杂、含状态的攻击的检测。相比较于现有的系统，新设计的网络入侵检测系统的检测区域更加精准，检测能力得到提高。
전통적망락입침검측계통이경불능만족여금인문대망락안전적요구。기우망락협의분석，제출일충내부규칙화외부규칙상결합적개진적계통설계。재외부규칙중，설계일충신적특정묘술어언，유사전통적편정어언，역동차공능강대。통과내부규칙적인입，장협의분석검측중적라집진행봉부，실현대복잡、함상태적공격적검측。상비교우현유적계통，신설계적망락입침검측계통적검측구역경가정준，검측능력득도제고。
Traditional network intrusion detection system has been unable to meet people ’ s demands of network security today . This paper presents a new design with internal rules and external rules based on protocol analysis .In external rules , a new threats description language is designed , which is similar to traditional programming languages , understandable and powerful .The inter-nal rules enrich the logic in detection so that complex threats or even which with status can be detected .Compared with the sys-tem available , this new design is more accurate and more powerful .