Anomaly Detection System Based On Behavioral Correlates

Intrusion detection system, as a kind of active security tool, can detect the invasion before the attack on the system is happened. It also expels the invasion through the system of alarm and protection. So it can overcome the shortcomings of the traditional security technologic passive defense. Intrusion detection system based on different data sources can be divided into the system based on the network, the system based on the host and the hybrid intrusion detection system. All model of intrusion detection system consists of three modules, which respectively is the information collection module, the information analyzing module and alarm and response module.The system designed in the thesis also includes the three modules referred in the last paragraph. The intrusion detection method is a key factor related to the performance of the intrusion detection system. Intrusion detection technology includes the misuse detection and abnormal detection. In the thesis, an abnormal intrusion detection method based on behavioral correlates is researched, which is based on the summary of the advantages and disadvantages of the existing methods. Although this method simplifies the characteristic index, there is still a high rate of detection success. This method is applied to the information analysis module in the intrusion detection system. It guarantees the system referred in the thesis can have good protection against illegal intrusion and security.