【作者】 魏强；

【导师】 梅松；

【作者基本信息】 华中科技大学 ， 计算机技术， 2011， 硕士

【摘要】 Snort作为一款知名的开源的入侵检测系统(IDS),从它诞生直到现在一直受到众多网络安全工作者的研究。本文的目的就是以Snort为基础,将这个知名的入侵检测系统设计成为一个实用的入侵防御系统(IPS)。本文首先介绍了IPS入侵防御的原理。从网络攻击与防御的基本知识出发,分析当前网络安全的基本情况。其中主要介绍了一般网络入侵的几个过程,并由此引出入侵检测系统IDS,以及由IDS与防火墙联发展而来的IPS的基本情况。然后对现有的入侵检测系统Snort进行系统分析。除了介绍了Snort的基本知识以及要将其为基础设计成为一个入侵防御系统所缺少的功能外,还分析了它现有系统存在的几个缺陷。其中主要指的是Snort庞大的而分类混乱的规则集和其报警日志系统中所存在的问题。针对原有系统中存在的问题,第三章中以实现IPS为目的,对系统进行了整体设计。通过Linux内核协议栈中提供的机制,实现Snort了对数据包的强力控制,在这个基础上,又提出了将环境变量生效地点置于内核,将规则进行合理分类,以及对报警日志进行合并与分类等方法来解决原有系统中存在的几大问题。最后是对整个系统的实现以及测试。结果证明,本文中所设计的这个IPS系统,不仅实现了IPS的功能,而且很好解决了原有系统中发现的问题。是一个具有一定实用性的入侵防御系统。更多还原

【Abstract】 Purpose of this article is designing an intrusion prevention system, which based on the famous Snort, which is researched by numerous network security workers.Firstly, it introduces the principle of IPS(Intrusion Prevention System). From the basic knowledge of network attack and defense, the author analyzes the basic situation of current network security, especially the general network intrusion processes. After that, it introduces the IDS and IPS.Then the article analysis the existing Snort, which is known as an open-source IDS. The author shows the basic knowledge on Snort firstly, and then talks about the IDS’s main problems, which refers to Snort’s rule sets and alarm log system.In the third chapter, in order to realize the IPS, the author gives the overall design of the system. And it gives the methods to solve the original Snort’s problems, too. When the Snort realizes the aim to control network packets, the design puts the environment variables in the kernel, and manages the rule sets by using a reasonable classification, and creates a new method to merge and classify the alarm information.The last is to realize of the entire system and test. The results of test prove that this design in this IPS realized the function of IPS and solved the problems found in the original system very well, at the same time. It is a practical Intrusion Prevention System.更多还原