【作者】 楼亮；

【导师】 薛质；

【作者基本信息】 上海交通大学 ， 通信与信息系统， 2007， 硕士

【摘要】 随着信息技术的迅猛发展,互联网和信息共享成为信息社会的主要趋势,越来越多的信息系统依赖于当前的互联网,信息安全成为一个不可回避的话题逐渐摆在我们的面前。入侵检测技术是继防火墙,数据加密等传统安全保护措施之后新一代的安全保障措施,也是我们研究的重点。Snort是一种高性能的跨平台,轻量级入侵检测系统,其强大的功能和灵活性可以满足多种应用环境的需求。本文先对网络应用环境中存在的安全威胁进行了分析,提出了网络安全所要考虑的基本问题,然后对入侵检测系统的基本结构进行了分析,紧跟着对snort的结构特点和规则进行来研究。接下来进行了提高入侵检测性能的关键技术分析,在此基础上给出了针对snort探测引擎的分析和改进,对LKR多模式匹配算法进行了实现,并应用二次散列进行了改进,随后提出了snort检测引擎整体的改进方案。其后,对基于snort的分布式入侵检测系统进行了分析,并且对于snort系统的规则匹配算法进行了改进,在不影响检测结果的基础上加快检测的速度。最后,提出了在Virtual Honeynet上实现连接历史算法以增强snort检测蠕虫能力的方案。更多还原

【Abstract】 With the information technology developing rapidly, Internet and information sharing become the trend of current information society. More and more information systems in diverse fields are dependent on Internet currently. The Intrusion Detection is a new security technology, apart from traditional security protect technology such as firewall and data crypt.We are studying intrusion detection today. Snort is a lightweight and powerful IDS,which has powerful function and flexibility.Snort can be used in various situations.In the first place this article analisessecurity threatens lie in network applications,basic consideration of network security and the status of IDSs in this module. Then I analyse the basic destruction of IDS and the regulars ,destruction of snort as well.In the following charters I set out to analyse the vital technology to increase the ability of IDS,based on which I give out analyse and improvement of snort detection engin,and also realize the LKR and inmpove it.Then I get a total case to improve snort.What’s more I research the Connect-history algorithm and found that realize it on a Virtual honeynet can give improvement the worm detection ability of snort.更多还原