误用型网络入侵检测实现方案研究.docVIP

华中科技大学 硕士学位论文 误用型网络入侵检测实现方案研究 姓名：张文君 中请学位级别：硕士专业：通信与信息系统 指导教师：刘玉摘要 长期以来，网络用户一般采用防火墙作为计算机网络安全的首道防线，但随着 网络攻击者知识的H趋丰富，其攻击工具与手段的日趋复朵，单纯的防火墙应用已 无法彻底保障网络系统安全，这就要求用户必须采用多样和纵深的安全检测手段。 在此背景下，入侵检测系统作为一种十分重要的安全检测工具，已逐渐成为了网络 安全的第二道防线，通过与防火墙等技术结合应用，使计算机网络对非法攻击和破 坏表现得更为健壮。然而近年来，随着大型网络以及T?兆以太网的普及，传统的入 侵检测系统难以跟随网络E速前进的步伐，进而面临极为严峻的挑战。 本文在分析误用型网络入侵检测系统通用模型的基础上，对项目中现有系统的 实现方案提出改进措施，设计出适用于当前快速发展的网络环境的入侵检测方案。 该方案通过在已有多模式匹配算法的基础上，引入了 Boyer-Moore-Horspool (BMH)算法中坏字符移动表的思想，将字符串匹配过程中一部分时间开销转移到 模式添加时的预处理过程中，从而使得入侵检测的性能得以提升。 同时，设计中还根据该系统的特点和应用环境，提出了一种基于扩展型ACL 规则的连续端口展开算法，通过简化使用ACL规则进行数据包筛选的过程，减少 了入侵检测数据提取的时间开销。 木文最后给出了改进后系统的性能测试结果，测试数据表明该系统完全满足设 计耍求，并已在多款路由器设备上成功应用。本课题所研究的误用型入侵检测方 案，还可方便地移植到屯子邮件、电子商务安全检测等诸多领域，具有广泛的应用 前景O 关键词：入侵检测访问控制列表端口展开算法多模式匹配算法 Abstract Networking consumers, for a long period of time, have used to utilize the firewall as the first safeguard for their systems on beating against system intrusion. However, as the development of the networking attack techniques, it becomes not sufficient for the security requirements of our networking by only using the firewall. Therefore, other possible networking security tools should be considered, and one of the most significant tools, the intrusion detection system (IDS), which works with the firewall and other applications to detect the networking intrusion cooperatively, has been coming into the focus as the second safeguard candidate. Recently, because of the quick augmentations on large scale networks as well as the Gigabyte Ethernet, it becomes challenging for the current IDS to keep up with the rapid development. In this thesis, we propose an advanced IDS which agrees with current network environment based on the analysis on universal model of the misapplied IDS. In this approach, based on the Ach-Corasick multi-pattern matching algorithm of the original IDS, we make improvements by applying the idea of Boyer-Moore-Horspool (BMH) algorithm which can transfers the part of the time cost on the process of string matching t