入侵检测系统已经被网络建设和管理人员所熟知,一个大型网络为了加强自身网络安全,通常都会部署入侵检测系统,通过多个“探头”实时监控重要网段状况,利用集中管理的中央控制台对所有“探头”进行管理。然而网络管理员(或网络安全管理员,下面简称网管)面对控制台上不断滚动的告警信息,却经常显得无所适从。往往忙活半天对一条条告警信息进行追查后,却发现是误报;而面对不断滚动的报警信息不能及时从中发现攻击事件又会导致漏报。所以有些网管人员经过一番试用后,甚至放弃了对入侵检测系统的使用。 Intrusion detection system has been known by network construction and management personnel, a large network in order to strengthen their own network security, usually deployed intrusion detection system, through multiple “probe” real-time monitoring of important network segment status, the use of centralized management of the Central Console All “probes” are managed. However, the network administrator (or network security administrator, hereinafter referred to as the network management) in the face of constantly rolling alarm information on the console, but often do not know what to look for. Often busy for a long time to track a piece of warning information, but found to be false positives; and in the face of constantly rolling alarm information can not be found in time to attack will lead to omissions. So some network administrators after some trial, and even abandoned the use of intrusion detection system.