文档介绍：第6章网络安全防范技术
计算机网络安全
张纯容
入侵检测与入侵防护系统
近几年网络安全研究的发展过程
防火墙技术的研究:在网络边界保卫内部网。
VPN技术的研究:连接分散的内部网,完成内部网外延的扩大,与防火墙技术结合比较紧密。
认证、PKI技术的研究:进一步扩大内部网的外延,同时建立广义的信任关系。
入侵检测技术的研究:承接防护和响应的过程。
入侵检测(Intrusion Detection,ID)
入侵检测就是对(网络)系统的运行状态进行监视,发现各种攻击企图、攻击行为或者攻击结果,以保证系统资源的机密性、完整性与可用性。
一个完整的入侵检测系统必须具备下列特点:经济性、时效性、安全性、可扩展性
入侵检测的发展简介
可分为3个阶段:
安全审计Security Audit): 审计定义为对系统中发生事件的记录和分析处理过程。
入侵检测系统(Intrusion Detection System,IDS)
入侵防范系统(Intrusion Prevention System,IPS,又称为入侵防护系统或入侵保护系统):IPS技术可以可以深度感知并检测流经网络的数据,对恶意报文进行丢弃以阻断攻击,对滥用报文进行限流以保护网络带宽资源
Common Intrusions
MARS
Remote Worker
Remote Branch
VPN
VPN
VPN
ACS
Iron Port
Firewall
Web Server
Email Server
DNS
LAN
CSA
Zero-day exploit
attacking work
Intrusion Detection Systems (IDSs)
An attack is launched on work that has a sensor deployed in promiscuous IDS mode; therefore copies of all packets are sent to the IDS sensor for packet analysis. However, the target machine will experience the malicious attack.
The IDS sensor, matches the malicious traffic to a signature and sends the switch mand to deny access to the source of the malicious traffic.
The IDS can also send an alarm to a management console for logging and other management purposes.
Switch
Management Console
1
2
3
Target
Sensor
Intrusion Prevention Systems (IPSs)
An attack is launched on work that has a sensor deployed in IPS mode (inline mode).
The IPS sensor analyzes the packets as they enter the IPS sensor interface. The IPS sensor matches the malicious traffic to a signature and the attack is stopped immediately.
The IPS sensor can also send an alarm to a management console for logging and other management purposes.
Traffic in violation of policy can be dropped by an IPS sensor.
Sensor
Management Console
1
2
3
Target
4
Bit Bucket
Common characteristics of IDS and IPS
Both technologies are deployed using sensors.
Both technologies use signatures to detect patterns of misuse work traffic.
Both can detect atomic patterns (single-packet) po