入侵检测和Snort初探要点分析.docVIP

入侵检测和Snort初探 摘要:随着信息化进程的深入和互联网的迅速发展，人们的工作、学习和生活方式正在发生巨大变化，效率大为提高，信息资源得到最大程度的共享。但必须看到，紧随信息化发展而来的网络安全问题日渐凸出，如果不很好地解决这个问题，必将阻碍信息化发展的进程。然而，传统的网络安全技术已经很难对付这些日益严重的安全威胁，所以我们就有必要去开发专门的工具去避免这些不安全因素的攻击，而入侵检测技术便可以作为一种很重要的技术为我们所用。 本论文从入侵检测的基本理论和入侵检测中的关键技术出发,主要研究了一个简单的基于网络的Windows平台上的个人入侵检测系统的实现(PIDS，Personal Intrusion Detection System)。论文首先分析了当前网络的安全现状，介绍了入侵检测技术的历史以及当前入侵检测系统的关键理论。分析了Windows的网络体系结构以及开发工具Winpcap的数据包捕获和过滤的结构。最后在Winpcap系统环境下实现本系统设计。本系统采用异常检测技术，通过Winpcap截取实时数据包，同时从截获的IP包中提取出概述性事件信息并传送给入侵检测模块，采用量化分析的方法对信息进行分析。系统在实际测试中表明对于具有量化特性的网络入侵具有较好的检测能力。 关键词：网络安全；Snort；入侵检测； Abstract: with the rapid development of informatization and Internet, peoples work, study and life style is having the huge change, the efficiency is greatly improved, the greatest degree of information resources sharing. But we must see, the problem of network security following the development of informationization and the growing bulge, if this problem is not solved, the information will hinder the development process. However, the traditional network security technology has been difficult to deal with the increasingly serious security threat, so we have the necessity to develop specialized tools to avoid the unsafe factors of attack, and intrusion detection technology can be as one of the most important technologies for us to use. Starting from the basic theory of key technology in the detection of intrusion detection and intrusion of the thesis, the main research a personal network intrusion detection system Windows platform based on simple (PIDS, Personal Intrusion Detection System). This paper first analyzes the current network security status, introduced the history of intrusion detection technology and key theory of current intrusion detection system. Analysis of Windows network architecture and development tools Winpcap packet capture and filtering. Finally, this system is designedin Winpcap environment. The system uses anomaly detection technology, through the Winpcap real time da