Active Mapping防止NIDS误报和漏报的重要手段

因为网络的复杂性．网络入侵检测系统(NIDS)并不总能准确地判断出什么样的网络信息到达了主机．也不总能判断主机如何去释意这些信息。因此．就TCP／IP协议分析而言,NIDS和主机对数据包的解析存在分歧。入侵者就可以利用这一漏洞逃过NIDS的检测。为了消除基于TCP／IP协议分析的分歧——“模糊性”,这里我们介绍一种简单的解决方法：Active Mapping技术。     

千兆应用入侵防护系统-AIP

随着对网络安全问题的理解日益深入．入侵检测技术得到了迅速的发展．应用防护的概念逐渐被人们所接受．并应用到入侵检测产品中。而在千兆环境中．如何解决应用防护和千兆高速网络环境中数据包线速处理之间的矛盾．成为网络安全技术发展一个新的挑战。     

一种适用于可信网络客户端的可信度量方案（英文）

The trusted network connection is a hot spot in trusted computing field and the trust measurement and access control technology are used to deal with network security threats in trusted network.But the trusted network connection lacks fine-grained states and real-time measurement support for the client and the authentication mechanism is difficult to apply in the trusted network connection,it is easy to cause the loss of identity privacy.In order to solve the abovedescribed problems,this paper presents a trust measurement scheme suitable for clients in the trusted network,the scheme integrates the following attributes such as authentication mechanism,state measurement,and real-time state measurement and so on,and based on the authentication mechanism and the initial state measurement,the scheme uses the realtime state measurement as the core method to complete the trust measurement for the client.This scheme presented in this paper supports both static and dynamic measurements.Overall,the characteristics of this scheme such as fine granularity,dynamic,real-time state measurement make it possible to make more fine-grained security policy and therefore it overcomes inadequacies existing in the current trusted network connection.