Tongxin xuebao (Jan 2003)
Study and implementation of integrated network security monitoring system
Abstract
The main intention of intrusion detection system （IDS） is to detect the action of unauthorized use, misuse, and all other abuse of computer systems, but it lacks of an effective monitoring console. In this paper, a novel model of integrated network security monitoring system （NSMS） is proposed, not only NSMS can capture different kinds of intrusion events from multiple and distributed heterogeneous Sensors, but also it can correlate these relative proofs, finally it can visualize the reasoning process. In this paper, we present the framework of NSMS, and then discuss some key issues of implementation, which are proof-getting, 損roof-correlation and result-visualization respectively. As the kernel of integrated network security and defense system, the prototype of NSMS has already been developed and tested, it is proved to be efficient, open and practical in network security monitoring.
