【作者】 王德正；

【导师】 欧阳一鸣；

【作者基本信息】 合肥工业大学 ， 计算机应用技术， 2007， 硕士

【摘要】 互联网的开放性为信息共享和交互提供了极大地便利，但随之而来的网络安全问题也日益严峻。入侵检测作为一种主动的信息安全保障措施，有效地弥补了传统安全防护技术的缺陷。入侵检测是继防火墙、数据加密等传统的安全保护措施后的新一代网络安全保障技术，它对计算机和网络资源的恶意使用行为进行识别和响应，不仅可以检测来自外部的入侵行为，也可监督内部用户的未授权的活动。通过对网络上的数据流进行实时分析，可以发现潜在的入侵威胁，最大限度地提高系统的安全保障能力，降低入侵对系统造成的危害。随着网络规模的不断扩大和入侵手段的不断更新，对入侵检测技术也提出了更高的要求。本文在研究国内外现有的入侵检测技术发展现状及发展方向的基础上，提出模式匹配和协议分析技术相结合的思想。在深入研究入侵检测系统常用的模式匹配方法的基础上，提出了改进的模式匹配算法(NFMSA)；将新一代的协议分析方法应用到网络入侵检测系统(NIDS)中，结合误用检测和异常检测，给出基于模式匹配和协议分析的网络入侵检测系统模型和设计过程。最后，通过实验证明系统具有较高的检测率、检测效率和可用性。本文所做的主要工作和新的见解如下：●详细论述了网络安全状况，阐述了入侵检测技术的现状和不足。●阐述了入侵检测系统的定义、分类、工作原理和发展方向。●研究了几种经典模式匹配算法，在总结各算法优点的基础上，提出高效、快速多模式匹配算法，提高系统检测的全面性、准确性和检测效率。●在对TCP／IP协议原理进行分析和研究基础上，把模式匹配技术和协议分析技术结合起来，建立入侵检测系统框架。●将简单协议分析技术和状态协议分析技术结合在一起，利用网络协议高度规则性，快速探测攻击的存在。●设计了入侵检测系统原型，对系统部分模块进行测试，并对实验结果进行了分析。更多还原

【Abstract】 The openness of internet offers great convenience of information sharing and exchange, accompanied with crucial challenges to information security. As a kind of active measure of information assurance, intrusion detection acts as the effective complement to traditional protection techniques. Intrusion detection system is new generation of safety protection technology after firewall, data encryption security. It carries on the recognition and the response to the malicious use behavior of the computer and the network resources, not only from the exterior, but also from the internal. By real-time analyzing network data packages, network intrusion detection system can detect latency intrusion; greatly contribute to improving the assurance ability of information systems and reducing the extent of security threats. However, the increasing expansion of the network scale and the increasing renewal of the intrusion method require intrusion detection system with higher quality.Based on the research of IDS developing status and direction at home and abroad, the author puts forward the idea that pattern matching combines with the technology of protocol analysis. Then ,after deeply having a study on common pattern matching methods of IDS, the author brings forward an improved pattern matching algorithm-NFMSA, introduces the method of latest protocol analysis to the network intrusion detection system so that misuse detection can be integrated with anomaly detection, and detailedly sets forth the model and design process of network intrusion detection system based on pattern matching and protocol analysis. Finally, the system is proved to have usability and high efficacy and efficiency of detection with experiment.The main work and novel ideas of the thesis are showed as following:The detailed description of network safety status and IDS’s situations and defections.The detailed survey of definition, classification, principle, directions of Intrusion Detection System.Based on the deeply study typical pattern matching methods of IDS, the author puts forward multi-pattern matching algorithm, improving system completement, detection efficacy and efficiency.Based on research of the principle of TCP/IP protocol analysis, the author constructs Intrusion Detection System frame with combination of the technology of pattern matching and protocol analysis. Combined the Simple Protocol Analysis technology with Stateful Protocol Analyzed technology, intrusion detection system can detect existing attacks high speedly.The design and development of Intrusion Detection System prototype system, testing parts of system modules and analysis the result of experiments.更多还原