文档介绍：基于协议分析的入侵检测系统
摘要
由于互联网应用的大规模的快速增长,传统的防火墙已经不能满足互联网对安全的需求,因此网络安全作为一个无法回避的问题被提出。入侵检测系统IDS,Intrusion Detection System,作为一种新的安全防御措施,是传统防火墙的补充策略,对网络安全的发展以及应用具有十分重要的意义。协议分析技术凭借着其诸多优势在网络安全领域迅速发展起来。由于其具备解析数据包、探测分散的多个数据包中的网络攻击、减少误报和漏报率、真正的高性能等多项技术优势,常常被用来和模式匹配算法结合起来,在误用检测系统中使用。用Ubuntu系统作为开发平台,开发一基于协议分析的入侵检测系统, 该系统主要对捕获的数据包进行协议解析,提取有效数据,通过与特定攻击的规则进行匹配,找出可疑或攻击行为,做出响应并记录结果。
论文主要工作如下:
1、论文首先分析了现有入侵检测产品所存在的问题。针对这些问题,提出了选用协议分析和遗传神经网络技术来构建入侵检测系统中规则检测器和行为检测器的设计思路。
2、利用协议的高规则性, 进行协议树、协议解码以及协议分析过程的设计,给出协议分析检测器的基本步骤;结合遗传神经网络算法的思想设计了行为检测器,并详细分析了适应度函数、交叉算子、变异算子以及其他控制参数,给出了核心参数的确定方法。
3、根据本文入侵检测模型的设计方法,结合各模块的实现原理,完成了基于规则与行为的入侵检测模型的开发。其中,在数据采集模块中利用Winpcap函数定义了数据捕获机制的核心数据结构和函数。
关键词:入侵检测,协议分析技术,遗传算法,神经网络,遗传神经网络
论文类型:
Subject: Potocol analysis-based intrusion detection system
Specialty: Computer Aplication
Name:
Supervisor: Professor
ABSTRACT
Since large-scale applications, the rapid growth of traditional firewalls can not meet the demand for security, so work security as an unavoidable problem have been proposed. Intrusion Detection System IDS, Intrusion Detection System, as a new security defense measures supplement the traditional firewall strategy, the development and application work security is of great significance. Protocol analysis technology by virtue of its many advantages in the field work security has developed rapidly. Because of its analytical data packets to detect a plurality of data packets work attacks and reduce false positives and false negative rate, the real high number of technical advantages, are often used together and pattern matching algorithms, in error with the detection system as a development platform used to develop an intrusion detection based on protocol analysis system, which mainly captured packets for protocol analysis, extract valid data, with particular attack matching rules to identify suspicious or aggressive behavior, do the response and the results recorded.
Thesis work is as follows:
1, The paper firstly analyzes the e