【作者】 杨俊玲；

【导师】 张连芳；

【作者基本信息】 天津大学 ， 计算机应用技术， 2007， 硕士

【摘要】 随着计算机及网络的飞速发展,Internet拥有越来越多的用户,计算机网络安全成为人们面前一个非常现实且不可回避的问题。网络用户传统上采用防火墙作为安全第一道防线,而随着攻击者知识的日趋成熟,攻击工具和方法也日趋复杂,单单依靠防火墙已经无法保护网络安全,必须采用一种纵深、多样的手段。在这样的背景下,自上世纪九十年代以来,入侵检测是一个非常活跃的研究领域。入侵检测系统(Intrusion Detection System)作为一种检测针对计算机和网络系统非法攻击使之免遭破坏的重要部件应运而生。由于近年来网络技术日新月异的发展,网络上存在海量数据,使目前的网络入侵检测系统很难跟上网络快速发展的步伐,传统的入侵检测方法面临严峻挑战。本文首先介绍了入侵检测系统的模型、分类和工作原理以及所存在的问题,然后深入研究了Linux内核的网络实现,分析了Linux2.4内核的网络接受瓶颈,介绍了Linux2.6内核的网络改进。在此基础上,本文设计一种了基于Linux内核桥模式的入侵检测系统。有别于传统网络入侵检测系统旁路监听的方式,该系统使用了桥模式的入侵检测方式,对数据包的检测在数据链路层进行。系统还使用了Linux多线程编程技术,使得系统的检测与防护工作分布在不同的CPU上执行,以此达到数据包检测快速、高效的目的。对该系统在真实网络环境下进行的正常访问及入侵测试试验表明:本文设计的基于Linux桥模式的入侵检测系统达到了无漏报、快速、高效的效果,可以有效的检测入侵,同时保障了对正常访问的响应。更多还原

【Abstract】 With rapid development of computer and network, network security is a practical and unavoidable problem. Network consumers adopt firewall as the first line of defense traditionally. It is impossible to protect network only depending on firewall as more and more attack tools and more complicated ways of attacking have been appearing. It is necessary to adopt more comprehensive and various means. Intrusion detection is a very active field of research since 1990’s. Intrusion detection system is a component to detect illegal attacks, which aims at computer system and computer network, to avoid being destroyed.At present, network intrusion detection system cannot keep up with development of network technology, owing to huge amount of data in network. Traditional approaches of intrusion detecting face serious challenge.In this paper, we first introduce the model of intrusion detection systems, and their working principles of intrusion detection systems, and their existing problems. We then studied deeply the implementation of networking in Linux 2.6 kernel, and analyzed network bottleneck of Linux 2.4 kernel, introduced some improvement of 2.6 kernel. Based on above study, we designed an bridge model IDS on Linux. Different of the bypass model monitor in traditional IDS, our system uses bridge model monitor, and detect packet on data-link layer. By using multithread programming technology of Linux, detection and protection are carried out in different CPUs separately, in order to achieve efficient and fast data packet detection. The experiments, conducted in real network environment, show that our Linux based bridge model IDS, designed by us, can meet the requirement we anticipate. It can detect intrusion efficiently and without“false negative”, at the same time, the system can guarantee everage network usages.更多还原