网络攻击源追踪系统模型

入侵检测是识别网络攻击的主要手段，现有的入侵检测系统可以检测到大多数基于网络的攻击，但不能提供对真实攻击来源有有效追踪。据此，结合现有的入侵检测技术提出了网络攻击源追踪系统的模型，阐述了该系统的体系结构和各部分的主要功能，给出了利用相关性分析对攻击者的攻击路径进行回溯的基本思想，模拟结果表明，所提出的系统模型和相关性分析的思想是可行有效的。最后，从安全性，实用性和追踪精度等方面对系统可能存在的问题进行了分析。

A Framework of Network Attacker-Tracing System

Intrusion detection is a major technique of identifying the network attackers. The intrusion detection systems available can find the event of most network based attacks, but cannot judge the real locations of attackers. On the basis of the existing techniques, this paper presented a framework of network attacker tracing system. It then provided the system architecture and listed the principal functions. By using of the relevant analysis, it gave the basic idea of retracing the attackers' paths. The simulation result shows that the framework and idea are feasible and efficient. Finally, the potential problems of such system from various respects such as security, practicability and tracing precision, etc. were analyzed.