【摘要】 对于一个网络入侵检测系统,协议分析主要有三方面的作用:为检测引擎提供输入,提高检测的有效性,提高检测效率。对于这些功能,该文论述的协议分析子系统对应有三个功能模块:基本协议数据解析模块,包括对数据包各个头部字段的解析;上下文相关的数据关联模块,包括IP分片合并和TCP会话重组;应用层协议分析模块,包括对常见应用协议数据的关键字段的提取和分析。文章的最后给出了系统的应用层协议分析的性能测试数据。更多还原

【Abstract】 Protocol analysis sub-system in intrusion detection system has three important functions:supplying data to detection engine,improving the effectivity of detection and improving the efficiency of detection.According to these functions,the protocol analysis sub -system described in this paper implements three modules:basic protocol parsing module,including parsing the header fields of a packet;context analysis module,including recombinating IP fragments and reconstructing TCP sessions;application protocols analysis module,including abstracting keyword from application protocol messages.The test result of application protocols analysis module is provided in the last paragraph.更多还原