【摘要】 分析了基于特征的Snort入侵检测系统,并在此基础上实现了Snort向IPv6网络环境的移植。为了提高入侵检测系统中检测引擎的速度和效率,在分析Snort的规则组织结构和规则匹配过程的基础上,提出了一种IPv6动态规则匹配机制。按照特征参数和共同选项来进一步划分规则,为规则选项关联快表项,对规则匹配的顺序进行动态调整,从而提高了规则匹配速度。实验结果表明,该系统可有效地检测IPv6各种攻击,平均规则匹配速度提高了约19.2%。更多还原

【Abstract】 Snort intrusion detection system based on features is analyzed. And based on this, the porting of Snort system into IPv6 network environments is implemented. To improve the speed and efficiency of intrusion detection engine in an intrusion detection system, the organizational structure and rules matching process of Snort are analyzed, and a dynamic rule matching mechanism for IPv6 is introduced. In order to adjust the sequence of rule matching dynamically and to improve the efficiency of rule matching, the rules of Snort rule option according to eigenvalue and common items are classified and a chain of fast item is associated with the rule option. The experiment shows that the system not only detects kinds of attacking for IPv6, but also increases average rule matching speed about 19.2%.更多还原