ppt课件-snort-annetworkintrusionpreventionanddetectionsystem（snort-annetworkintrusionpreventionanddetectionsystem）.pptVIP

Snort - an network intrusion prevention and detection system Student: Yue Jiang Professor: Dr. Bojan Cukic CS665 class presentation Overview What’s snort? Snort architecture Snort components Detection engine and rules in snort Possible research works in snort. What’s snort? NIDS: A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. Snort: an open source network intrusion prevention and detection system. It uses a rule-based language combining signature, protocol and anomaly inspection methods Snort: the most widely deployed intrusion detection and prevention technology and it has become the de facto standard technology worldwide in the industry. Snort A packet sniffer: capture and display packets from the network with different levels of detail on the console Packet logger: log data in text file Honeypot monitor: deceiving hostile parties NIDS: network intrusion detection system Typical locations for snort Requirement of snort lightweight NIDS small, flexible highly capable system Snort architecture Snort components Logical components of snort Packet Decoder: takes packets from different types of network interfaces (Ethernet, SLIP,PPP…), prepare packets for processing Preprocessor: (1) prepare data for detection engine; (2) detect anomalies in packet headers; (3) packet defragmentation;(4) decode HTTP URI; (5) reassemble TCP streams. Detection Engine: the most important part, applies rules to packets Logging and Alerting System Output Modules: process alerts and logs and generate final output. TCP/IP layer Snort work on network (IP) layer, transport (TCP/UDP) layer protocol, and application layer Detection Engine ※ Requirement Time critical Fast Detection engine Number of rules Traffic load on the network Speed of network and machine Efficiency of detection algorithm Rules