【作者】 李全存；

【导师】 刘东飞；

【作者基本信息】 武汉理工大学 ， 计算机应用技术， 2006， 硕士

【摘要】 入侵检测是计算机安全领域的一项重要技术,也是当前计算机安全理论研究的一个热点。随着因特网技术的不断发展,设计并实现一种能够适应因特网环境的入侵检测系统已成为入侵检测领域的热门话题,然而,现行入侵检测系统大都局限于单一的主机或网络架构,或者大都采用集中式的结构,对异构系统及大规模网络的监测明显不足。为了解决这些问题,实现大规模异构网络环境下的入侵检测和安全响应,研究一种能够适应因特网环境的入侵检测系统即分布式入侵检测系统,已经成为网络安全发展的必然趋势。本文在国内外相关研究的基础上,结合分析大规模分布式入侵攻击行为的特征,将多传感器信息融合技术应用于分布式入侵检测系统中,建立了一种适合大规模异构网络环境下的分布式入侵检测系统理论模型即基于攻击策略树的分布式入侵检测系统。 本文的主要内容如下: 第一章,介绍了本课题研究的目的和意义以及国际国内研究现状与进展,并提出了本文要解决的问题以及本文的主要工作; 第二章,首先介绍了入侵检测的基本概念与发展历史,接着,详细介绍了入侵检测的分类与标准化工作,最后引入了分布式入侵检测概念; 第三章,对分布式入侵攻击的行为特征进行了分析,提出了攻击事件的概念; 第四章,首先对攻击事件进行分类,然后提出了攻击事件模型,并根据IDMEF标准对攻击事件模型用NML语言进行了形式化描述,最后详细描述了攻击事件模型中的关键字段,阐述了攻击事件之间存在的时序与逻辑关系: 第五章,在第四章攻击事件模型的基础上,结合Tidwell攻击树的概念建立了攻击策略树的定义,并提出了一种攻击策略树的形式化描述语言对攻击策略树进行了形式化描述,接着,将Quinlan的决策树知识应用于攻击策略树模型中,建立了攻击策略树生成算法,最后,介绍了攻击策略树在入侵预测中的应用; 第六章,对目前存在的分布式入侵检测系统体系结构进行分析与比较,提出了基于攻击策略树模型的分布式入侵检测系统体系结构,设计并实现了一个基于linux平台的一个原型系统; 第七章,全文总结与展望。更多还原

【Abstract】 Intrusion detection is an important technology in the computer security fields, and also it became a focus in the computer security theory. With the development of internet technology, designing and implementing an intrusion detection adapted to the internet environment became a popular topic in the intrusion detection fields. But currently most of IDS are limited to a single host/net infrastructure or center structure pattern, IDS detectability is sick in heterogeneous-configuration or largely scope network environments. To settle these problems, implementing and researching a distributed intrusion detection system to be adapted to the internet environment become a consequential trend. By researching the correlated information and combining with the attack practices, more sensor data fusion is applied to the Distributed Intrusion Detection System (DIDS). In this thesis, a distributed intrusion detection system theory model adapted to the large scope heterogeneous-configuration environment is raised that is distributed intrusion detection based on the attack policy tree (APTDIDS).The main contents of this thesis can be summarized as follows:In Chapter 1 Introduce the intention and goals of this thesis and actuality about this field today, secondly raise the main problem to be settled and main work to be done in the thesis.In Chapter 2 First, introduce the intrusion detection based concepts history, and then described the classification and standard of intrusion detection, at last, import the distributed intrusion detection.In Chapter 3 Analyzed signature of the distributed attack behavior, and raised the attack events.In Chapter 4 First, classified the attack events, and then raised a model of attack events, in the term of IDMEF (The Intrusion Detection Message Exchange Format) standard described the attack events by XML(eXtensible Markup Language), at last described the key fields in the attack event model, and expounded time sequence and logic relations in different events.In Chapter 5 Based on the model of attack events and combined the Tidwell Attack Tree concepts, an attack specification language is constructed. Secondly, Quintan’s Decision Trees is used to the Attack Policy Tree Model (APTM), and an Attack Policy Tree Spanning Algorithm (APTSA) is constructed. At last, APTSA is used to forecast the attack intrusion.In Chapter 6 Analyzed and compared currently DIDS infrastructure, A distributed intrusion detection system infrastructure is given, and a prototype is implemented based on Linux.In Chapter 7 Summarized the whole thesis and discussed the research and technical trend of IDS.更多还原