【作者】 柳飞；

【导师】 杨世平；

【作者基本信息】 贵州大学 ， 计算机应用技术， 2006， 硕士

【摘要】 在现代社会互联网飞速发展的同时，入侵攻击，拒绝服务攻击，网络资源滥用等威胁如影随形，为互联网带来很多负面的影响。面对这些挑战，很多公司采用了一系列的安全软、硬件来保证安全。但是，由于产品间联动性较差，安全策略的人为疏忽，层出不穷的新型威胁等，企业的安全并没有得到保障。这时需要一种智能化较高的安全软件，入侵检测软件就能很好的满足这些。但是一套入侵检测软件价值不菲，少则数万，多则几十万，给企业的信息建设提供了很大的负担，因此需要找到一种既稳定，又能满足要求，高效且价格尽可能低的入侵检测系统(IDS)。本文就是基于这个目的，考察业界中的IDS系统，提出以免费、开源和高效的SNORT为代理的分布式IDS系统。小到家庭，大到企业级应用，都可以利用SNORT来进行入侵检测。 本文首先介绍了计算机安全的由来及要求，常见的计算机危害(如：病毒，木马，蠕虫，内部或外部人为攻击，人为误用、滥用等)，并对入侵检测的产生和发展进行了深入的剖析，分析了入侵检测的现状，指出基于网络的NIDS和基于主机HIDS的优缺点，随后提出基于SNORT代理的分布式入侵检测系统的构建方式。它有机的结合了基于网络的IDS和基于主机的IDS，达到了很好的效率和功能的结合，并且通过大量的SNORT插件对网络数据的捕获，预处理到分析和数据都有了一整套的解决方案。更多还原

【Abstract】 With the rapid development of INTERNET in modern society, intrusion attack, denial of service attack, misuse of INTERNET resource, bring many negative effects to the common use. There is one solution can give us some good things to solve this, that is intrusion detection system—IDS. Considering the IDS costs too much, I give one solution here based on the SNORT IDS which is free. The SNORT IDS is a free, powerful, and effective intrusion detection system, and it can handle almost every field of IDS, ranging from family use to enterprise use.In the first section of paper, I describe the basis of computer security, and those items like virus, Trojan, worm, human attack, etc, also showed in this paper.In second part, I show the difference of network intrusion system (NIDS), host intrusion detection (HIDS), and distribute intrusion detection (DIDS). At the same time, the good aspects and bad aspects of the three IDS showed in this section.On the third part, I create one solution of DIDS named XIDS, which means experiencing intrusion detection system. The XIDS is based on the SNORT IDS. With many plug-INS, the XIDS can handle, analysis the information sniffed from many SNORT agents established in the monitored network, store the tracks of intruders, and alert the administrator to focus.Finally, I also describe some shortcomings of XIDS, and discuss the future of IDS.更多还原