【作者】 潘振业；

【导师】 李学干；

【作者基本信息】 西安电子科技大学 ， 计算机系统结构， 2005， 硕士

【摘要】 随着网络技术的日益发展，尤其是Internet的日益普及，网络安全问题受到越来越多的人关注。IDS(入侵检测系统)是继防火墙、数据加密等传统安全保护措施后新一代的安全保障技术，得到了越来越多的应用。由于网络规模的不断扩大和入侵手段的不断涌现，传统的基于模式匹配的入侵检测技术已经不能适应入侵检测需要。而协议分析是基于网络协议的高度规则性，它是继模式匹配之后的第三代入侵检测技术，能适应新的入侵检测的需要。 本文首先分析当前网络安全问题的现状，指出了研究和发展入侵检测系统具有非常重要的意义：接着介绍了入侵检测的概念、技术、分类以及标准化等；并重点研究了模式匹配和协议分析，改进了模式匹配的经典算法—BM算法；最后以CIDF(通用入侵检测系统)框架模型为基础，提出了基于模式匹配和协议分析的入侵检测系统，该系统具有高效性、准确性高、低资源消耗等的优点。更多还原

【Abstract】 With the rapid development of computer and network, when more and more companies and users surf Internet, more and more people have focused network security. IDSs (Intrusion Detection System) are a new type of safety protection technology after traditional security protection method such as firewall, data crypt, etc. and are widely employed. Because of constant expansion of network scale and constant emergence of new intrusion methods , traditional intrusion detection technology based on pattern matching has not adapted to demand of intrusion detection. But protocol analysis based on altitudinal regularity of network protocol is the third-generation intrusion detection technology after pattern matching and can adapt to new demand of intrusion detection.Firstly, this dissertation analyzes the present situation of network security problems, pointing out that the research and development of intrusion detection system have very important meanings. Then the dissertation presents the concept, technology, classification, and standardization of intrusion detection, etc, and intensively studies pattern matching and protocol analysis and improves the pattern matching classical algorithm, the algorithm of BM. Finally, according to common intrusion detection framework, the dissertation proposes the architecture of intrusion detection system based on pattern matching and protocol analysis, and the system has many advantages such as high efficiency, high accuracy , low consumption of resources, etc.更多还原