基于多核的IDS测试工具基本框架的设计与实现-计算机系统结构专业论文.docxVIP

摘 摘 要 摘 要 随着互联网的发展，网络攻击和入侵日益严重，IDS 成为网络防护重要手段之 一?市场上出现了众多的入侵检测系统产品，不同厂商 IDS 设备的报警日志格式 各异?因此，本文提出了一种具有高效在线检测?自动添加攻击规则数据?报警 日志自动分析等功能的 IDS 测试工具的基本框架? 本文阐述了国际上一些著名的实验室和研究机构的测试方法和理论，并对目 前出现的 IDS 测试工具进行分析和研究?借鉴国家标准 GBT 20275-2006 和 NSS 测试方法，给出了一种基于 Tilera 多核处理器系统和 Sourcefire VRT 开发和维护的 snort IDS 规则新描述方法的 IDS 测试工具的基本框架，该框架包括了上位机控制 分析程序和多核 IDS 测试设备程序?上位机控制分析程序由上下位机命令交互模 块和 IDS 报警日志分析模块组成；多核 IDS 测试设备程序由控制命令处理模块? 规则信息处理模块?测试数据包生成模块和模拟攻击模块组成? 本文设计的基于多核的 IDS 测试工具基本框架，实现了对 IDS 漏报规则的检 测，完成对不同厂商 IDS 漏报率性能测试? 关键词：入侵检测系统 测试 基本框架 多核技术 Tilera Ab Abstract Abstract With the rapid development of the Internet, network attack and invasions are becoming more and more serious, therefore accordingly, IDS is one of the important security protection ways. Many of the IDS products appeared on the market and IDS devices from different manufacturers have various log formats, so the paper aims to give an foundation framework of IDS testing tool with functions such as efficient on-line inspection, adding rules and analyzing alarm log automatically. The classical testing methods and theories from some international famous labs and research institution have been elaborated, and the current emerging IDS testing tools also have been analyzed and studied. Based on national standards for reference GBT 20275-2006 and NSS testing method, we provide a kind of IDS testing tool combining rules of snort IDS which Sourcefire VRT develops and maintains with the feature of Tilera multi-core processor system architecture. The foundation framework of testing tool for IDS based on multi-core includes host control and analysis program and multi-core IDS testing device program. The former is composed of host command communication module and IDS alert log analysis module. The latter consists of processing control commands module, processing information of rules module, generating test packets module and simulating network attack module. The false positive are tested respectively by the testing tool for IDS based on mu