基于P2P和移动代理的入侵检测系统研究

【作者】 徐长棣；

【导师】 刘方爱；

【作者基本信息】 山东师范大学 ， 计算机应用技术， 2007， 硕士

【摘要】 随着互联网的迅速发展,网络安全问题越来越受到人们的重视。随着攻击者技术的日趋成熟,攻击工具与手法的日趋复杂多样,单纯的防火墙策略己经无法满足当前的需要,网络的防卫必须采用一种纵深的、多样的手段。与此同时,当今的网络环境也变得越来越复杂。在这种环境下,入侵检测技术作为一种主动的信息安全保障措施,能根据入侵行为的踪迹和规律发现入侵行为,从而有效地弥补了传统安全防护技术的缺陷,成为当前网络信息安全领域研究的热点和重点。但传统的入侵检测系统仍存在一些缺陷,如在分布性、灵活性、协作性、检测效率等方面还不尽人意。为了解决当前分布式入侵检测系统中存在的负载不均衡、单点失效以及传输瓶颈等问题,本文设计了基于P2P和移动代理的入侵检测系统P2PIDS。该系统利用P2P网络技术、入侵检测系统Snort以及与IBM公司的移动代理平台Aglet相结合,具有良好的检测性能和灵活性,能够充分发挥对等网络技术的特点,实现各检测节点之间的相互协作,增强系统的系统检测能力,提高检测效率。⑴本文分析了网络安全研究的现状,详细介绍了通用的入侵检测原理、分类及常用的入侵检测技术,指出了入侵检测的发展趋势。分析了入侵检测系统Snort的框架结构、主要构件和主工作流程。然后又介绍了P2P网络的特点及其网络拓扑结构的分类,并对移动代理的体系结构和模型进行了分析。⑵从体系结构上把现有的分布式入侵检测系统进行比较,说明了其各自的优缺点,同时借鉴已有的研究成果,提出了基于P2P和移动代理的入侵检测系统P2PIDS的体系结构,并对系统中各个代理的结构和功能进行了详细的设计和阐述。然后提出了系统中各节点的通信协作机制和负载均衡机制。最后对系统中的主要模块进行了结构设计,入侵检测模块主要由Snort来实现,系统监控模块通过系统监控代理和管理代理实现。⑶实现了系统中的关键模块,通过实验,说明了提出的通信协作机制和负载均衡机制能有效降低丢包率,提高系统的检测效率。⑷对本文设计的P2PIDS进行了总结,分析了其优点和存在的问题,提出了下一步的研究方向。更多还原

【Abstract】 As the fast development of INTERNET, the network security problem attracts many people’s attention. As the attackers are becoming more mature, and the attack tools and ways are becoming various. The firewall strategy can not meet the needs any longer. So the defense of network needs to be deeper and more multiplex. At the same time, the network environment is becoming more and more complex. Under this situation, as a kind of active measure of information assurance, IDS finds the intrusion from the trace and pattern of their actions. It acts as the effective complement to the traditional protection techniques. It has become the focus of network security research. It acts as the effective complement to traditional techniques. However, the traditional intrusion detection systems have some shortcomings in certain aspects, such as flexibility, interoperability etc.In order to solve the problem of the existing kinds of distributed intrusion detection system, such as the unbalanced load, single-point invalidation and transmission bottlenecks etc, a novel intrusion detection system is proposed in this paper which is based on P2P architecture and mobile agent technology----P2PIDS (Peer-to-Peer Intrusion Detection System). The system uses P2P network technology, IDS Snort, and IBM’s Mobile Agent Platform Aglet, which make the system have certain flexibility, interoperability, intelligence as well as good performance. It can play the characteristics of the P2P network technologies, and achieve cooperation among the detecting nodes. It can also enhance the system’s detection capability and improve the efficiency of detection.(1) This paper analyzes the current situation in network security, introduces the general principles, classification of intrusion detection in particular, and indicates the trend of IDS development. It analyzes the structural framework of the IDS Snort, the main component and the main work flow in detail. Then, the topology of the P2P network and its classification are introduced, Mobile Agent architecture and model are also for analysis.(2) It shows the advantages and disadvantages of the exiting IDS through comparing their structure. The author introduces the design of the system architecture and expounds the design and implementation of P2PIDS in detail. Communication cooperation mechanism and load balancing mechanism in P2PIDS are proposed in this thesis. Finally, the author designs the main modules of the system. The intrusion detection module is actualized by Snort, and the systematic monitoring module is actualized by SMA and MA.(3) It actualizes a system prototype, and then, proves that the communication cooperation mechanism and load balancing mechanism can effectively reduce the rate of dropping packets and improve the detection efficiency.(4) The paper ends up with a summary of P2PIDS. Finally the author summarizes the advantages and disadvantages of this system, and talks about the future research orientation.更多还原