文档介绍：华中科技大学
硕士学位论文
高速网络环境下入侵检测系统的设计与实现
姓名:薛鹏
申请学位级别:硕士
专业:通信与信息系统
指导教师:程文青
20090522
摘要
传统的入侵检测系统在低速网络中能够较好的工作,但在高速网络中却有较大的
性能瓶颈和处理缺陷。主要表现在两个方面:一是前端报文捕获速率不高,丢包现象
严重。二是后端数据处理速率不高,主要是入侵检测系统的检测引擎处理效率低,对
于占据了大部分流量的基于 TCP 协议的应用层协议没有优良的处理机制,从而在高速
网络环境下误报漏报现象严重。
本文在对 Snort 系统源代码进行研究与分析的基础上,提出了一种高速网络环境
下入侵检测系统的设计与实现方案。包括两个方面:第一,针对传统入侵检测系统报
文捕获模块在高速网络下的各种瓶颈,提出了一种高速网络环境下的基于零拷贝算法
的报文捕获解决方案。该方案从减少数据拷贝次数,优化网卡驱动中断处理机制,减
少上下文切换等方面等对报文捕获模块进行优化,在一定程度上提高报文捕获性能。
第二,针对传统入侵检测系统检测引擎处理效率低,在高速网络环境下误报漏报率较
高的缺陷,设计了协议分析模块。该模块借鉴了 Snort 预处理模块中协议分析的思想,
并对其进行了更加丰富的设计,从而可以提高基于 TCP 协议的应用层协议的检测效
果。
此外,本文以 Snort 源码为原型,对本文提出的两个主要模块进行了实现,并在
模拟的千兆网络环境下进行了测试,测试结果表明本文提出的入侵检测系统在性能上
有一定程度的提高。
关键词: 入侵检测系统, 报文捕获, 协议分析, 零拷贝技术, 共享内存
I
Abstract
Traditional IDS (Intrusion Detection System) has good performance in low-speed
networks, but many performance bottlenecks in high-works. Mainly in two
aspects: First, the packet capture module has low efficiency and packets loss is a serious
problem. Second, the data-processing module has low performance, and the IDS detection
engine hasn’t a good mechanism to deal with the application layer protocol based on TCP
protocol, accounted for the majority of traffic, in high-work, so serious omission
detection e out.
In this thesis, based on the research and analysis of the source code of Snort system,
the design and implementation of IDS in high-work has been carried out.
Including two aspects: First, packet capture module of traditional IDS has a variety of
bottlenecks in high-work and so a packet capture solution based on zero-copy
algorithm with high performance is designed. The solution reduces the cost of data copy
and optimizes the interrupt handling mechanism of NIC (Network Interface Card) driver to
reduce the context switch cost and so on. Packet capture module is optimized and in
something improves the packet capture performance. Second, the detection engine of
traditional IDS has low efficiency and b