Design and Implement a IDS Based on Event driven

This article issue a new IDS plan, and give main implement. DEN System is a IDS base on ″event engine″, it work on data link level and use passive network monitoring, can make correct event when detect any abnormal situation, and drive event engine to processing it. The system have it's own language: DEN Script for users to define on command event processing code. DEN have many distingushing quality such as adept to high speed network stream, policy separate from mechanism, realtime notify and good extensible.