基于协议分析状态机的入侵检测系统

协议分析状态机是提高协议分析正确性的重要保证。将其应用于入侵检测系统是一个新的研究应用方向。协议的形式化描述工具有穷状态自动机、通信有限状态自动机。在此基础上重点讨论了使用协议状态机分析入侵事件的相关算法及流程，设计了基于协议分析状态机的入侵检测系统的总体框架，提出了该状态机的面向对象的模型，使该系统具有良好的可扩展性和通用性。测试结果验证了这一思想的正确性和有效性。

Intrusion detection system based on protocol analying state machine

Protocol analyzing finite state machine plays a very important role in guaranteeing the correctness of protocol analyzing. Protocol analyzing finite state machine is a new concept in intrusion detection system.In this paper,the authors try to apply protocol analyzing finite state machine to routing intrusion detection system.Authors show the formal models for protocol specifications: finite state machine and communicating finite state machine. And the authors also review the work on intrusion detection system based on protocol analyzing finite state machine on these models,analyse the problems and also show the implementation of intrusion detection system based on protocol analyzing finite state machine. And the authors also introduce, a protocol analyzing finite state machine architecture and analyse the experimental results of the intrusion detection system based on protocol analyzing finite state machine.