【作者】 唐谦；

【导师】 张大方；

【作者基本信息】 湖南大学 ， 计算机应用技术， 2005， 硕士

【摘要】 近些年来,随着网络安全问题的日益严峻,入侵检测系统已成为计算机与网络安全的重要组成部分。随着网络流量和速度的不断增加,快速性成为衡量检测引擎性能的重要指标。如何提高入侵检测引擎的速度一直以来都是研究的热点问题。本文研究了基于特征的入侵检测引擎,从两个方面着手,一是如何有效地组织与日俱增的入侵规则;二是在数据包与入侵规则进行模式匹配时,使用什么样的模式匹配算法来快速准确地检测出入侵行为。 本文采用Snort系统作为实验平台,该系统是世界上应用最广泛的丌放源代码的基于特征的网络入侵检测系统,在行业内有着重要的地位。对Snort中的两种检测引擎进行比较分析,传统检测引擎采用二维线性链表方法组织入侵规则,新方法采用决策树对入侵规则进行分类组织。在根据入侵规则构造决策树时,所依据的分类属性选择标准对决策树的形状和深度有很大的影响。本文提出在构造决策树时采用信息增益率为新的分类属性选择标准,并用它替代了原有的信息增益标准。实验结果证明,对于某些特定的攻击类型,改进后的入侵检测引擎在检测速度上有明显的提高。 模式匹配算法是基于特征的入侵检测引擎中的重要部分。本文分析了入侵检测中常用的几种模式匹配算法,并分别在混合攻击和特定攻击的条件下进行了性能测试,根据实验结果,得出了不同算法的应用范围,为今后入侵检测系统开发者选择模式匹配算法提供了有价值的参考。最后,本文针对Aho-Corasick算法内存消耗量优化的问题,采用了一种称之为压缩的稀疏向量多带状存储格式,并将它应用到Aho-Corasick算法的状态表压缩存储中。实验结果表明,采用多带状存储格式的Aho-Corasick算法的内存消耗量有明显的降低。更多还原

【Abstract】 In recently years, the network security is more and more rigorous. Intrusion detection system is one of important components of computer network security defense system. With the increasing network traffic and speed, speed is a important metrics to evaluate intrusion detection performance. How to increase the speed of the intrusion detection engine has been a hot research problem. This article researchs the signature-based intrusion detection engine, there are two aspects, one is how to organize intrusion rules effectively. The other is which pattern match algorithm can be used to detect intrusion quickly and accurately when the packet matching intrusion rules.This paper uses Snort as the experiment tool. Snort is the most popular the signature-based intrusion detection system because it is open source, Snort has the important position in the intrusion detection field. This paper analyses two kinds of detection engine in Snort. Traditional detection engine uses 2-dimension list to organize rules, new technique uses decision tree to organize rules. The choice of attribute selection metric to split has an important impact on the shape and the depth of the resulting decision tree. This paper uses a new attribute selection metric to construct decision tree, called the gain-ratio criterion, replace the gain criterion. For the certain particular attack, experimental evaluation shows that the detection engine utilized gain-ratio criterion has significantly improved the speed of detection process.Pattern matching algorithm is the important part of the signature-based intrusion detection engine. In the condition of mixed attack and single attack, experiment evaluates the performance of the above algorithms. Experimental evaluation shows that different algorithms have different application area. It provides valuable reference for developer to pick out adaptive pattern matching algorithm for intrusion detection system. Final, the paper emphasizes on how to optimize memory consumption of Aho-Corasick algorithm. This paper uses a new storage format, called Compressed Sparse Vector Multi-Bands Storage format. Experiment shows Multi-Bands Storage format can reduce memory consumption obviously.更多还原