【作者】 温世强；

【导师】 吴建平；

【作者基本信息】 清华大学 ， 计算机科学与技术， 2004， 硕士

【摘要】 随着互联网的飞速发展，计算机系统和计算机网络所面临的安全问题越来越严重。网络上可随意下载的攻击工具和不断出现的攻击方法使网络攻击越来越容易，特别是网络蠕虫等恶意移动代码造成了多次全球规模的互联网瘫痪。入侵检测（Intrusion Detection）技术是计算机网络安全防范体系的重要组成部分，对入侵检测系统的迫切需求也使得相关研究成为网络安全领域的热点课题。本文首先介绍了入侵检测技术的概念、分类和历史，总结了入侵检测技术的现状和发展趋势。然后针对校园网入侵检测的需求，设计并实现了一个校园网分布式入侵检测系统。系统由分布在网络各节点的监测代理(MA)收集信息，在统计服务器（SS）上进行数据集中和归并，最终由管理服务器（MS）进行分析，向管理员发出报警信息。该系统实现了误用检测、异常检测、攻击源追踪三个方面的功能。误用检测针对的是已知其特征的攻击，例如已知的病毒、蠕虫等恶意代码，在Snort的基础上实现了数据的归并、统计分析功能，并利用攻击特征交换协议（ISEP）实现了多个Sensor特征库的自动更新；异常检测在多个MA上采集并分析流量数据，在统计服务器上检测流量的异常特征。针对未知蠕虫的检测，在异常检测的功能中，还设计并实现了一种网络蠕虫爆发检测算法，该算法通过对网络流量变化率的统计，可以在蠕虫爆发的前期发现网络异常特征，从而使网络管理员和应急响应组织获得更多的反应时间，在蠕虫阻塞网络之前采取措施。针对假冒源地址的分布式拒绝服务 (DDoS) 攻击行为，系统中还包含了一个攻击源追踪子系统，可以在此类攻击发生时确定出攻击源的真实位置。本系统已经在清华大学校园网中局部试用，取得了预期的效果。更多还原

【Abstract】 With the rapid development of internet, the security problem of computer system and network is more and more serious. Now, one can download kinds of attack tools from internet and plentiful new methods of intrusion appear continuously. It makes network attack to be more easily. Especially MMC (Malicious Mobile Code) such as internet worm and so on has made global scale internet paralysis for many times. Intrusion Detection technology is one of important component of network security architecture. The urgent requirement of Intrusion Detection System causes the relative research into a hot-spot topic of network security field. This paper first introduced the concept, classification and history of Intrusion Detection technology, summarized its present situation and development tendency. Then in view of the Intrusion Detection requirement of campus net, designed and implemented a distributed Intrusion Detection System for campus network. The system can collect information by Monitor Agents (MA) on network nodes, carry on the combination of data by Statistical Server (SS), finally accomplish the analysis by Manage Server (MS) and send out alert messages to administrators.This system has three functions: misused detection, anomaly detection, and attack source traceback. Misused detection focuses on the intrusions whose characters have been known, such as virus, worm and so on. It implements functions of data combination and statistical analysis basing on Snort software. And then it completes the automatic renewal of Sensors intrusion signatures by Intrusion Signature Exchange Protocol (ISEP); Anomaly detection collects and analyses traffic data from many MAs, then detects the anomaly signature by SS. Aiming at detection of the new unknown worms, we designed and implemented a detection algorithm of internet worm <WP=5>eruption. This algorithm can find anomaly in the forepart of worm eruption according to variable rate of network traffic. Thus it causes network administrators and emergency response teams obtain more reaction time to make responses before network blocks down. To prevent Distributed Denial of Service (DDoS) attacks of their fake source address, this system has also contained an attack source traceback subsystem. It can locate such attacker’s real position when intrusion occurs.This system has partially been tested in Tsinghua University campus net and achieved anticipated effects.更多还原