一种基于对等网的分布式入侵检测系统三模型分析.docx

摘要入侵检测技术是保障网络安全的一个重要手段。随着网络规模的 摘要 入侵检测技术是保障网络安全的一个重要手段。随着网络规模的 扩大和攻击方式的分布化，分布式入侵检测系统的研究成为热点。虽 已有一些分布式入侵检测产品问世，但它们仍存在单点失效、可扩展 性差和效率不高等亟需解决的问题。 论文对入侵检测技术和分布式入侵检测系统的体系结构进行了分 析，并结合目前广泛应用的对等网络技术，设计了·种基于对等网的 分布式入侵检测系统模型。该模型采用对等网络模式构建了一种分布 式网络架构，通过动态地将对等结构中的部分节点升级为Super-Peer 来承担网络管理职能。模型从逻辑上可划分为分布式网络管理单元和 入侵检测功能单元两个部分。论文讨论了分布式网络管理单元的设计 与实现，着重阐述了模型的通信机制和分布式成员协作方法。为保障 系统自身的安全，模型采用安全套接字协议来提供节点间通信和协作 时的身份认证，成员间需要通过4次握手才能建立对等连接。入侵检 测功能单元部分采用误用检测技术构造了一个基于协议分析的入侵检 测系统，改进了特征库的设计，．尤其是为了避免在入侵协作检测过程 中因特征库不一致而产生漏洞的问题，新增了特征库同步更新的功能。 通过单机和联网两种模式的测试，结果表明论文设计的模型配置 灵活，提高了系统的健壮性和可扩展性，解决了分布式系统常见的单 点失效问题，在效率方面较基于纯对等网模式的分布式系统有了明显 提高，基本达到了设计要求。 关键词入侵检测，对等网，特征库，分布式系统 The The technology of intrusion detection is all important part in the field of network security research．With the extension of network scale and distribution of attack method．DIDS(distributed intmsion detection system) has developed into a focus in this field．Although there are some commercial products of DIDS available．it’S still a problem to make the DIDS sharing data e伍ciently among its members and to advance the performance of DIDS． The technology of intmsion detection and the architecture of DIDS are analysed in this paper．Then，a model of DIDS based on Peer-to—Peer iS designed as a combination of the technology of intrusion detection and that of Peer-to．Peer．The model iS logically devided into two units：the unit of peers manager and that of intrusion detection system．The way how the unit of peers manager runs and the details about how it constructs are introduced．To advance the efficiency of distributed system，a distributed network structure iS implemented in the model by making use of the technology of Peer-to．Peer which iS a substitution for the C／S model．Peers of the distributed system is charged by the super-peer which is created automatically．In addition，an IDS(intrusion detection system)is implement— ed by making use of the specifications of protocol and outstanding pattern matching algorithm．It is a stress to redesign