【作者】 杨昌乐；

【导师】 李之棠；

【作者基本信息】 华中科技大学 ， 计算机系统结构， 2004， 硕士

【摘要】 IDS在网络安全体系中占据着重要的位置。然而当前的IDS技术都有自己的缺陷:异常检测误报率太高,目前还难以在市场得到应用;误用检测的攻击特征不能实时更新,容易导致漏报,同时,随着特征规则的增多,检测效率下降。针对误用检测应用中出现的问题,网络情境入侵检测系统(NCIDS,Network-Context based Intrusion Detection System)给出了一个新的解决方案。NCIDS根据IDS监听报文的特点,利用用户层报文映射技术,从网卡上直接过滤报文,并拷贝到应用层可以访问的区域,从而再进行报文截获时跳过操作系统的协议栈,避免了操作系统核心频繁的检测和拷贝。通过对网络环境的分析、连接状态的监视,并且拓展了事件描述语言,由原先的1层表示法拓展为2层表示法,NCIDS给出了基于网络情境的检测方法。根据网络情境,NCIDS模拟目标主机上的协议解析过程,将报文还原,然后再进行特征匹配,从而使许多绕过IDS的入侵方法在NCIDS面前不再有效。NCIDS将规则按照协议的方式组织成不同的小集合,每次匹配时根据解析的结果只需要对集合内的规则进行匹配,大幅度减少了对报文内容的匹配次数,同时采用当前已经证明比较高效的匹配算法:Boyer-Moore、Aho-Corasick、Wu-Manber等,并可以根据需要进行选用。最后,NCIDS将数据挖掘算法应用于入侵检测领域,对审计记录进行各种模式的分析,使自身具备了规则自动发现的功能。更多还原

【Abstract】 Intrusion Detection System (IDS) plays a very important role in the architecture of today’s internet security. But the technologies of IDS product are defectively. For example, Misuse detection technology has high false negatives, and anomaly detection technology has high false positives. These flaws restrict the development of IDS. Network Context based IDS, NCIDS for short, employs a new detection technology which is based on network context to fetch up these flaws. Many Network IDS (NIDS) use the Libpcap library to capture packets from network, so the packets have been copied many times before NIDS can reach it. This is inefficient. NCIDS maps its user space memory into kernel space, and so it can handle the packets directly without copying it from kernel space to user space and avoids the Operation System’s check-up, which is needless in IDS.By detecting the network topology and recording the connection’s state, NCIDS emulates the parsing procedure in the destination host of the packet. And after this, NCIDS uses its corresponding contextual signatures to match the data of the parsed packet. By doing so, NCIDS greatly enhances the ability to reduce false positives. Almost all signature-matching based IDS have no idea about how to add new rule to its rule database by the IDS itself. So these IDS can’t detect novel intrusion. NCIDS solves the problem by using data mining technology to mine rule from its record database. NCIDS uses association rules algorithm to determine the relationships between fields in the audit records, and the frequent episodes to model the sequential patterns. After this, NCIDS can find new attack signature and add it to the rule database if the administrator agree. So NCIDS can keep itself sensitive to novel attack.更多还原