【作者】 刘萍萍；

【导师】 申铉京；

【作者基本信息】 吉林大学 ， 计算机软件与理论， 2004， 硕士

【摘要】 互联网的发展为全球范围内实现高效的资源和信息共享提供了方便，但同时也对信息的安全性提出了严峻的挑战。现在，信息安全已逐渐发展成为信息系统的关键问题。传统的基于主体的信息安全模型已经不能适应网络技术的发展，P2DR模型应运而生。入侵检测技术是P2DR模型的重要组成部分。入侵检测作为一种主动的信息安全保障措施，是对“防火墙”、“数据加密”等传统安全防护技术的有效补充。它对计算机和网络资源的恶意使用行为进行识别，并为对抗入侵提供重要信息。它不仅检测来自外部的入侵行为，同时也监督内部用户的未授权活动。它有效地弥补了传统安全防护技术的缺陷。通过构建动态的安全循环，可以最大限度地提高系统的安全保障能力，减少安全威胁对系统造成的危害。随着计算机技术和网络技术的不断发展，分布式计算环境的广泛采用，海量存储和高带宽传输技术的普及，传统的基于单机的集中式入侵检测系统已不能满足安全需求。黑客技术的不断发展特别是分布式拒绝服务攻击（DDOS）的出现已经使分布式入侵检测（Distributed Intrusion Detection, DID）逐渐成为入侵检测乃至整个网络安全领域的研究重点。本文针对面向大规模网络的分布式入侵检测的关键问题进行了一些研究。本文首先对网络安全现状、当前的网络安全技术进行了一定的研究；然后从信息系统的安全模型开始，介绍了基于主体访问对象的经典安全模型和P2DR动态安全模型；阐述了入侵检测系统对于维护信息系统和计算机网络系统的重要性，随后提出了本文要完成的工作——研究适用于大规模网络的分布式入侵检测系统。然后，研究了入侵以及入侵检测技术概念的提出背景和发展过程。分析了入侵检测系统基本的工作原理、系统模块。从业界的研究热点以及已有的商业化产品两个方面介绍了目前该领域的研究和技术现状。随后介绍了分布式入侵检测技术的产生背景和优势；分析了其相对于传统入侵检测系统的优势。随后按照基于组件的以及基于主体的分类方法介绍了目前国内外用于解决分布式入侵检测的系统架构和具体的检测技术，包括一些处于实验阶段的原型系统和较为成熟的规范。在系统模型设计方面，本文提出了一种层次化协作的混合型分布式入侵<WP=82>检测系统模型。该模型将受保护网络划分成若干个安全管理区，并且该模型由探测代理、监视代理、策略执行代理三个部分组成。各部分之间角色的分工借鉴了CIDF模型，并且在每种代理的内部模块的设置上也力求功能完整独立。整个模型在数据来源的分布化、分析检测的分布化、多区域检测的协作化三个层次上体现分布式入侵检测的特点。另外，监视代理的数据融合部分采用了分析探测代理发送的事件之间相关度的方法提取局部异常事件。随后，给出了实现该模型的重点问题。分布式入侵检测系统的消息交互是实现时的重点，是体现系统分布化、协作化特性的关键所在。本文在组件的消息交互方面做了深入的研究。结合对通信机制、消息内容的需求并且在综合分析国内外的研究方法的基础上，设计了各种交互消息的具体内容并且依据这种消息结构给出了系统运行期间组件之间注册、注销、处理简单攻击以及处理协同攻击时的消息交互流程。本文在Windows 2000平台下构造了基于规则的网络探测代理，其中的规则集使用的是Snort的。并且在Snort的规则解析基础上，提出了改进的规则解析方法——将Snort的二维规则链表重新划分成规则子集，并针对传输层协议给出了不同的集合划分方法。给出了在程序设计时遇到的若干技术问题的解决方案。最后，为了测试网络探测代理的运行效率进行了丢包率测试、CPU负载测试，测试结果表明在正常的网络通信中，系统可以达到有效的运行状态。此外，我们还通过测试4种扫描工具的攻击时间和可以检测到的攻击数目来测试系统的检测效率，结果表明，网络探测代理可以在较短时间内检测超过95％以上的扫描行为，并及时地采取响应措施。作为网络安全的一个重要研究领域，分布式入侵检测仍然存在着众多的问题和技术难点，本文的最后给出了今后针对该领域我们的研究方向。更多还原

【Abstract】 The development of Internet offers great convenience for efficient communion of global resources and information. But it also challenges the security of information severely. Nowadays information security has been a crucial problem of information system. Traditional information security model based of subject can’t adapt to the development of network technology, P2DR model emerges, as the times require. Intrusion Detection technology is an important component of P2DR model. Being a kind of voluntary information protecting measures, intrusion detection is complement of traditional security protect technology such as firewall, data encryption and etc. It identifies the malice activities of utilizing computer and network resources and offers important information to confront intrusion. Not only does it detect outer intrusion behavior, but also it can supervise unauthorized activities of inside users. It makes up the limitation of traditional security defending technology. By forming dynamic security circulation, it can increase the ensuring security ability furthest, and reduce the risk of security threaten.As the development of computer technology and network technology and the widely adoption of distributed compute environment, the traditional centralized intrusion detection system can’t meet the security need. The development of hacker technology, especially the emergence of distributed denial of service assault has made distributed intrusion detection the emphasis of intrusion detection and even the whole network security field. This paper studies the crucial problems of distributed intrusion detection aiming large-scale network.In this paper, we analyze the status of network security and the current network security technology firstly; and then we introduce classic security model based subjects access objects and dynamic security model based P2DR after introducing information security model; and we specify intrusion detection system’s importance to maintain information system and computer network system, after that, we advance the work to be completed in this paper ——<WP=84>studying distributed intrusion detection system aiming large scale network. Then, we studied the background of the conceptions and developing courses of intrusion and intrusion detection, and analyze basic work theory and system modules of the intrusion detection system. We introduce the status of the study course by recommending the research hotspot and developed commercial products. And then we introduce the system architectures and specific intrusion technologies of solving distributed intrusion detection system of both here and abroad according to method based of modules and method based of agents, including some prototypes under experiment and some mature criterion.As to the aspect of the system model designing, this paper put forward a hierarchical cooperation hybrid distributed intrusion detection system model. This model divides the network under protects into several security areas, and it is composed of sensor agent, monitor agent, countermeasure agent. The function divisions of the components use the reference of CIDF model, and we do our best to make the function of the modules full and independent. This model embodies the feature of distributed intrusion detection from the distribution of data resources, the distribution of analysis and the cooperation of multi-areas. In addition, the data fusing part of monitor agent utilizes the retrieve local abnormal events by analyzing the correlation of the events sent by sensor agents. After that, we advance the important problems of realizing the model.The component message exchange is stress of realization, and is the key point of distributed detection. We make deep research on message exchange. Based on the need of communication mechanism and message contents and after analyzing the research method of both here and abroad, we design various specific message content and the message exchange flow of login, logout, operating simple assault and operating complicate assault during更多还原