In order to understand accurately and use correctly cai in teaching practice , based on the theory of modern education , the author in the essay explains the strong points and weak points of cm , and focuses on analysing some problems for misusage of cai 摘要為了在教學(xué)實(shí)踐中正確認(rèn)識(shí)并合理使用計(jì)算機(jī)輔助教學(xué),文章結(jié)合現(xiàn)代教育理論,闡述了計(jì)算機(jī)輔助教學(xué)的優(yōu)勢(shì)及局限性,著重分析了計(jì)算機(jī)輔助教學(xué)在應(yīng)用中的一些誤區(qū)。
We do research on the transitions between states of network protocol , the protocol misusage detection model based on markov chain , the framework of the ids technology and protocol anormity after we discuss the current technology . the main research contents of this paper include : research on transitions between states of network protocol and session process , protocol misuage and the anomaly detection model based on markov chain , the research of intrusion detection framework , more accurately model based on the characteristic of the network traffic and so on 在分析了現(xiàn)有入侵檢測(cè)系統(tǒng)的基礎(chǔ)上,本文圍繞典型網(wǎng)絡(luò)協(xié)議狀態(tài)轉(zhuǎn)換、基于馬爾可夫鏈的檢測(cè)模型、入侵檢測(cè)技術(shù)框架、以及協(xié)議異常等幾個(gè)方面展開深入研究,主要工作內(nèi)容包括:典型網(wǎng)絡(luò)協(xié)議轉(zhuǎn)換狀態(tài)的分析和會(huì)話過程的研究;基于馬爾可夫鏈的網(wǎng)絡(luò)異常檢測(cè)模型;分布式的檢測(cè)架構(gòu);針對(duì)網(wǎng)絡(luò)流量特征而提出了精確的檢測(cè)模型等。
Then , the paper present a protocol misusage ids in application layer based on markov chain , and obtain the following results after test : the system can have good effection on detecting the probe packet , dos attack and novelty attack . the system can overcome part of disadvantages in traditional intrusion detection system , and adapt requirements with different network . the experiment shows that the system can improve the detection accuracy rate , reduce the false negatives probability 通過對(duì)檢測(cè)系統(tǒng)的測(cè)試分析,系統(tǒng)對(duì)掃描探測(cè)報(bào)文、 dos攻擊報(bào)文和新的攻擊報(bào)文等有較好的檢測(cè)率?;隈R爾可夫鏈建立的網(wǎng)絡(luò)異常檢測(cè)系統(tǒng)可以克服傳統(tǒng)入侵檢測(cè)系統(tǒng)的部分缺陷,能夠適應(yīng)不同網(wǎng)絡(luò)環(huán)境的要求,同時(shí)也有效提高了系統(tǒng)的檢測(cè)能力和檢測(cè)效率,降低了誤報(bào)率。
First of all , this paper introduce the markov chain theory . after analying the specifications of http , smtp , ftp , telnet and tcp , we know the tcp session is fit for the markov process . in this paper , we analyze the transitions between states of the application layer with the normal tcp traffic , and build a protocol misusage detection model with the normal traffic in darpa data set 本文采用了馬爾可夫鏈理論,仔細(xì)分析了tcp協(xié)議規(guī)范,并研究分析了典型網(wǎng)絡(luò)應(yīng)用層協(xié)議http 、 smtp 、 ftp以及telnet ,驗(yàn)證了基于tcp協(xié)議的會(huì)話過程就是一個(gè)馬爾可夫過程。