【作者】 姜华斌；

【导师】 谢冬青； 杨志纯；

【作者基本信息】 湖南大学 ， 控制工程， 2005， 硕士

【摘要】 在网络应用不断发展的今天,网络安全问题也日趋突出,越来越多的安全技术被应用到网络安全领域。而大部分安全措施都属于被动防御,缺乏积极的保护措施。入侵检测(Intrnsion Detection)是网络安全体系中新兴的一门技术,它是一种主动的防御技术,也是当今计算机和网络安全所关注的焦点。它能够及时检测出网络安全漏洞,迅速做出响应,增强了网络的安全性,它逐渐成为网络安全领域的研究重点。 首先,本文分析了通用的入侵检测原理、分类及常用的入侵检测技术,指出了入侵检测的发展趋势。 然后,针对现有入侵检测模型的特点及其存在的结构复杂、未能考虑检测事件的优先级等问题,提出了一种基于环形结构的分布式协同入侵检测系统模型,采用令牌控制技术来实现分布式协同,给出了令牌的结构,提出了事件优先级的计算和实现方法,并针对新的模型设计了一套较完善的入侵检测算法和环形结构的分布式协同入侵检测系统的协议。 同时,给出了基于环形结构的分布式协同入侵检测系统的框架和各功能模块的结构实现,采用了协议分析和模式匹配的技术进行入侵分析;并提出了改进的Boyer-Moore算法,使得模式匹配算法效率更高;构建了一个仿真环境,通过仿真实验,进一步验证了基于环形结构的分布式协同入侵检测系统操作方便,稳定性、可靠性、可扩充性好,具有较好的平均响应率和负载均衡,达到了预期的结果。 最后,总结了基于环形结构的分布式协同入侵检测系统的优点和不足之处,并提出了本文没有实现的功能和今后将进一步研究的方向。更多还原

【Abstract】 With the ceaseless development of network, network security is becoming more and more important and many security technologies have been used in network security fields. But most security measures belong to passive defense and are lack of positive safeguard. Intrusion Detection is a kind of novel technology in network security system, which is a kind of active defense technology and is becoming the focus of computer and network security. It can detect the security leak of network in time and response rapidly and enhance the security of network.First, the article analyzes the current principle, classification and the technology of Intrusion Detection in common use and predicates the direction of Intrusion Detection development.Then, the article puts forward a kind of distributed and coordinated Intrusion Detection System model based on annular structure for characteristic and being not considering the priority of detection events in existing Intrusion Detection model, introduces the idea of managing and coordinating annular model through the token, gives the structure of the token, provides the computation and realizing method of event priority, and designs a set of perfect arithmetic of Intrusion Detection and the protocol of annular structure of distributed and coordinated Intrusion Detection system.At one time, the article provides the framework of distributed and coordinated Intrusion Detection system based on annular structure and the structure of realizing each function module, adopts the protocol analyse and the technology of mode matching to analyze intrusion, and puts forward the improved Boyer-Moore arithmetic to make the mode matching arithmetic more efficient,and constructs an emulational enviroment to validate the easy operation and good stability, reliability and expansibility and the better response ratio and load equilibria through the emulational experiments to achieve the expected results.Finally, the article summarizes the advantages and deficiencies of the distributed Intrusion Detection System based on annular structure and points out the function being not realized in the article and the further research direction for the future.更多还原