[互联网]局域网的安全攻防测试与分析.doc

【摘要】近年来，随着计算机在办公中的普及应用，局域网在办公中地位的日渐突出，针对局域网的攻击也日益增多。这类攻击有以病毒的形式进行传播和攻击，也有网络黑客的破坏和IP地址被盗用等各种形式，不论怎样，这都严重影响了计算机中数据的安全性。局域网(LAN)英文全称是“LocalArea Network”，主要是指在小范围内由网络服务器和多台电脑组成的工作组网络，下面将就就局域网的安全攻防的检测和分析，是层次化、集成化和智能化的测试和分析系统。采用分布式体系结构，应用集成防卫的理论和技术，建立策略数据库，提供智能的检测和分析机制，通过对信息数据的统计分析，实现对完了安全的综合管理。本文主要对IPv6局域网攻防原理、分类、危害进行阐述，再对两种具体的攻击：扫描攻击和阻止IP攻击，进行了原理分析，然后设计并实现两个Snort预处理器分别对着两种攻击进行攻击检测分析。本文使用一种实时警报分析框架（实时TIAA系统）通过预先学习的关联关系对Snort产生的警报进行匹配和关联，从而在海量警报中找到属于同一攻击序列的警报 【关键词】局域网 安全 病毒 Snort Sniffer 【abstract】In recent years, with the use of computers in the Office, LAN in Office position in the increasingly prominent, growing number of attacks against the local area network. This type of attack have spread in the form of viruses and attacks, hackers compromised and the IP address is, and other forms of piracy, in any case, this has seriously affected the security of data on your computer. Local area network (LAN) full name in English is LocalArea Network, mainly within the scope of a small working group composed of network servers and multiple computers network, the following LAN security testing and analysis of attack and defense, is hierarchical, the integration and testing and analysis of intelligent systems. With a distributed architecture, applied theory and integrated defense technologies, establish policies database, providing intelligent detection and analysis of mechanism, through statistical analysis of the data, enabling the out of integrated security management. Article on IPv6 local area network offensive and defensive principles, classification, hazard, and for two specific types of attacks: scan attacks and block IP attacks, analysis, and design and implement two Snort preprocessor, respectively on the detection and analysis of two kinds of attack attack. This article uses a framework for real-time analysis (real-time TIAA system) through learning that matches Snort alerts and associated relations associate, to find the same attack sequence in a mass alert warning; t