入侵

Intrusion detection analysis technology is the core of intrusion detection system which includes abnormity intrusion detection and abused intrusion detection.

入侵检测分析技术是入侵检测系统的核心，主要可分为异常入侵检测和误用入侵检测。

Phenotypic plasticity and genetic differentiation are the two major strategies that alien invasive plants can adapt habitat heterogeneity.The polymorphism of invasive plants and the diversity of their dispersal way enable them occupying invaded habitat quickly,and dispersing with a far range.The breeding strategies that agamogenesis and amphigenesis can coexist and trade off according to the habitat and invasive stage can not only promote the invasive population erupted massively,but also directly affect the dispersal mechanism and regulate the genetic structure of the population.

表型可塑性和遗传分化是外来入侵植物对生境异质性的两种适应策略；散布体多态型和散布途径多种化，使外来入侵植物迅速占领入侵生境，并进行远距离扩散；无性生殖和有性生殖并存，并根据生境和入侵阶段权衡的繁育对策不仅使入侵种群大面积暴发成为可能，而且直接影响散布机制并对种群遗传结构具有调节作用。

The trend of seawater is that the intrusion area varies as following rule: small to big to small; the intrusion distance: anear to far to anear. The condition of seawater intrusion has improved.

研究区海水入侵的趋势为：海水入侵面积和入侵程度有小→大→小的变化规律；海水入侵水平距离总体有近→远→近的变化趋势，海水入侵状况得到改善。

Among the diversity of security technologies, intrusion detection technology is one of the focuses. This thesis at first elicits the situation of nowadays intrusion detection technology and Intrusion Detection System after explaining the basic concept of intrusion detection. Then on the basis of analyzing some representative IDSs the shortcomings existing in traditional IDS are presented, such as being lack of distribute distributivity, flexibility, interoperability etc. Therefore new technologies are needed for explored to improve the overall performance of IDS.

入侵检测系统是目前网络安全领域的一个研究热点，本文首先从入侵检测的基本概念出发，阐述了入侵检测技术以及入侵检测系统的发展现状，通过分析当前一些有代表性的入侵检测系统指出了入侵检测系统存在的一些不足，在很多地方还有待改进，如分布式、灵活性、效率等方面，需要探索新的技术来提高入侵检测系统的整体性能。

Generally, the traditional Intrusion Detection Techniques can be categorized into anomaly detection or misuse detection. Based on the mechanism of computer immune system, this paper presents a new anomaly detection technique to detect intrusion into computer system. In this technique, a Markov chain model is used to represent a temporal profile of normal behavior of a process. The Markov chain model of normal profile can be created by learning the historic data of the sequence of system calls produced by privileged processes running on UNIX system.

传统的入侵检测技术，依照所基于的原则不同，通常分为误用入侵检测与异常入侵检测，本文在入侵研究中所采用的计算机系统免疫思想的基础上，提出了一种新的异常入侵检测技术，通过对特权进程系统调用序列的历史数据的学习，用马尔可夫链模型来建立特权进程的正常时态行为轮廓。

The severe seawater intrusion exists in certain eel farming factories within Changle, Fuzhou, in certain prawn farm within Jiuzhen county, Zhangzhou, and in certain saltern within Xiuyu district, Putian, all belonging to seawater intrusion in human activity areas. The maximum concentration of Cl and mineralization within those severe intrusion areas are 5629.00 mg/L and 33.16 g/L respectively. The slight seawater intrusion is monitored in Quangang district, Quanzhou, where natural conditions are kept. No seawater intrusion is monitored in Dongchong peninsula, Ningde. No soil salinization is monitored except Zhangzhou where the sand is slightly salinized.

在福州长乐市近岸某鳗鱼养殖片区、漳州漳浦县近岸某对虾养殖片区、莆田市秀屿区某盐田附近监测到严重海水入侵，均属人类开发活动影响区域内的海水入侵，严重入侵区域氯度最高达5629.00 mg/L，矿化度最高达33.16 g/L；在泉州市泉港区某自然村监测到轻度入侵，属自然状态下的海水入侵；在宁德东冲半岛外浒沙滩附近未监测到海水入侵；在漳州断面监测到土壤盐渍化，为轻度盐渍化土，其他断面为非土壤盐渍化土。

Firstly, an invasive species must be invasive enough in itself or has some biological distinction, such as quantitative and qualitative differences in the genome, or patterns of recombination. Secondly, to invade successfully, a new environment for an invasive species must be invasible, and this we may call the ecological basis of invasion. An invasive species may need to establish new interactions with other species, especially those mutualistic relations such as animal related pollination, seed dispersal by animals, mycorrhizal fungi, and symbioses between plants and nitrogen fixing bacteria.

首先从其自身来说，需要有足够的入侵性，这可以认为是入侵种的生物学基础，可能表现为具有多倍性、一定的遗传变异、杂合性或表型可塑性，以及不同的交配系统等；其次一个物种的入侵成功还取决于入侵生境的可入侵性，这可以认为是入侵种的生态学基础，而新的种间关系的形成，尤其是入侵种与其他种类的互惠共生关系的建成是关键。

The essence of EDID is to set up a normal behavior fuzzy sub collection A on the basis of watching the normal system transfer of the privilege process, and set up a fuzzy sub collection B with real time transfer array, then detect with the principle of minimum distance in fuzzy discernmethodThe innovation point of this paper is : Put forward the method of EDID, can not only reduce efficiently false positive rate and false negative rate, also make real time intrusion detection to become possibility; have independent and complete character database, according to the classification of monitoring program, design normal behavior and anomaly behavior etc., have raised the strongness of IDS; Use tree type structure to preservation the character database, have saved greatly stock space; in detection invade , carry out frequency prior principle, prior analysis and handling the behavior feature of high frequency in information table, have raised efficiency and the speed of detection, make real time intrusion detection to become possibility; have at the same time realized anomaly intrusion detection and misuse intrusion detection, have remedied deficiency of unitary detection method.

本文的创新点是：通过对特权进程的系统调用及参数序列的研究，提出了基于Euclidean距离的入侵检测方法EDID，不仅能有效降低漏报率和误报率，而且使实时入侵检测成为可能；设计有独立而完整的特征数据库，根据被监控程序的类别，分别设计正常行为、异常行为等，提高了检测系统的强健性和可伸缩性；特征数据库按树型结构存储，大大节省了存储空间；在检测入侵时，实行频度优先原则，优先分析和处理信息表中的高频度行为特征，提高检测的速度和效率，使实时入侵检测成为可能；同时实现了异常入侵检测和误用入侵检测，弥补了单一检测方法的不足。

With intrusion detection technology explored, and the cause of some important issues in intusion detection field that must be resolved immediately annalyzed, an Enhanced Intrusion Detection Agent ,, is presented, which works under the Agent-based Distributed Intrusion Detection framework, with an enhanced detection engine inside, and obtaining decision-making information from an Assistant Information Collecting Agent .

本文对入侵检测技术进行了分析和研究，通过分析入侵检测领域亟待解决的一些问题产生的根源，提出了在基于软件代理的分布式入侵检测模型框架下，使用一种以增强型入侵检测引擎为核心的入侵检测代理，并引入辅助的信息收集代理，协同解决基于模式匹配的网络入侵检测系统高虚警率低检测效率的设计思想，并在此想法的基础上实现了一个增强型的入侵检测代理(Enhanced Network Intrusion Detection Agent， E_NIDA)和一个辅助的信息收集代理(Assistant Information Collecting Agent，。A_ICA)。

The first guard line is a proactive intrusion response method based on intrusion graph, which can make proactive reactions in the forepart in order to prevent the final attacking goals from realizing, furthermore, to protect systems security. The second guard line is an intrusion response method based on damage containment techniques. This guard line will contain damaged data quickly and precisely, then release correct data contained mistakenly just now, which can maintain basic service functions for legal users even though intrusion response has been disabled.

一方面，利用基于入侵攻击图的先应式入侵响应方法，在检测到入侵行为的前期进行防御，在入侵者的攻击目的完全实现之前给予响应，尽量阻止其攻击目的的实现，并采用博弈方法进行策略分析，使系统的响应成本达到最低；同时利用基于数据破坏隔离技术的入侵响应方法作为第二道防线，在前期的入侵响应失效、关键数据已经被破坏的情况下，利用破坏隔离技术精确定位被破坏的数据并迅速释放被误隔离的数据，最大限度地提高数据利用率，从而保证系统向用户提供不问断的服务。

As she looked at Warrington's manly face, and dark, melancholy eyes, she had settled in her mind that he must have been the victim of an unhappy attachment.

每逢看到沃林顿那刚毅的脸，那乌黑、忧郁的眼睛，她便会相信，他一定作过不幸的爱情的受害者。

Maybe they'll disappear into a pothole.

也许他们将在壶穴里消失