基于免疫原理的网络入侵检测技术的研究-计算机软件与理论专业论文.docxVIP

摘要随着计算机互联网的发展和广泛应用，网络安全特别是网络入侵问题变得越 摘要 随着计算机互联网的发展和广泛应用，网络安全特别是网络入侵问题变得越 来越严重。因此，开展网络安全特别是入侵攻击与防范技术的研究，开发急需的、 高效实用的网络入侵检测系统，对计算机网络的发展和网络信息的建设与应用都 具有重要意义。 本文在对现有的入侵检测系统和生物免疫系统进行研究的基础上，对基于免 疫的入侵检测模型进行了探讨，并从健壮性、可扩展性、伸缩性和有效性等角度 对该模型进行了详细分析。从而得出改进现有入侵检测系统的方法，将生物免疫 系统的原理、结构和算法，应用于网络入侵检测系统的设计与实现。 最后，设计并初步实现了一个基于免疫的分布式网络入侵检测系统原型，该 系统监视TCP SYN网络数据包。每一个TCP SYN网络数据包都用表示为49位二进 制串。系统监视网络以发现其中的异常二进制串，异常二进制串代表了网络中的 异常网络连接。该系统原型具有分布式性、自适应性和健壮性等特征，而且既能 进行滥用入侵检测，又能进行异常入侵检测。 关键词：计算机安全入侵检测生物免疫系统滥用检测异常检测 ABSTRACTWit}l ABSTRACT Wit}l the rapid extension of intemet and wide application of Internet．network security,especially network intrusion，has become ever serious．Therefore，it is quite necessary for US to thoroughly analyze problems in network security,such as intrusion attack，to study intrusion detection technology,and also tO develop effective network intrusion detection systems fNmS)．Our research work is valuable and important for the development and application ofnetwork information systems． Through the research ofcurrent intrusion detection systems and biological immune system，an immunity based network intrusion detection model is discussed and analyzed in full detail from the view ofrobusmess，extensibili锄scalability,adaptability and efficiency．Thus the model indicates ways in which we can improve Our existing intrusion detection systems．That is applying biological principles，architectures，and algorithms extracted from IS to the design and implement of intrusion detection systems． Finally,we design and preliminarily implemented a prototype ofnetwork intrusion detection system based on immunity．It monitors TCP SYN network traffic． Each TCP SYN network packet is represented by a 49-bit binary string．The IDS monitors the network for the occurrence ofuncommon 49-bit binary strings．which represent unusual traffic patterns within the network．11prototype is distributed． adaptable and robust，further more，it carries out both anomaly detection and misuse detection． keyword：computer security