入侵檢測是網絡安全的一個新方向，其重點是有效地提取特征數據并準確地分析出非正常網絡行為。該文在深入研究分析公共入侵檢測框架理論和現有入侵檢測系統實現策略的基礎上，提出一種基于部件的入侵檢測系統，具有良好的分布性能和可擴展性。它將網絡和主機的入侵檢測系統有機地結合在一起，提供了集成化的檢測、報告和響應功能。
關 鍵 詞 入侵檢測; 通用模型; 模式匹配; 事件

Abstract Intrusion Detection is a newly developed area of network security. The main issue in this area is how to pick-up and analyze the information which contains abnormal network behavior characteristic. In this paper, basing on the research of CIDF and the implement strategy of intrusion Detection System, we design a component-based Intrusion Detection System, which has good distribute and scalable ability. It combine the network-based IDS and host-based IDS into a system, and provide detection, report and respond together.
Key words instrusion detection; common instrusion detection frame; pattern match; event