【作者】 黄永生；

【导师】 赵姝；

【作者基本信息】 安徽大学 ， 计算机技术， 2013， 硕士

【摘要】 伴随着网络技术的发展,计算机病毒和网络入侵攻击频发,对网络的恶意攻击也在增加,网络安全的重要性不言而喻。但是传统的安全防御机制主要采用被动防御原理,通过信息加密、身份验证、安全路由、访问控制、防火墙和VPN(Virtual Private Network)等安全措施来保护计算机系统及其网络基础设施。入侵者一旦利用系统漏洞或脆弱程序绕过这些安全措施,就可能获得对未经授权的资源的访问权,导致系统的崩溃而蒙受巨大损失。因此单纯依靠一些传统的静态的安全技术如防火墙、数据加密、身份认证等难以保证网络的安全,入侵检测作为一种主动的安全防护手段,为资源子网提供了动态的安全保障,即检测来自外部主机的入侵行为,又对内部的未授权活动进行有效监督。入侵检测能够发现恶意的或非授权系统与网络行为,重要的前提是合法行为与非法行为是可以区分的,也就是说,可以通过提取网络中行为的模式特征来分析判断网络中行为的性质。本文对网络上常见的入侵行为的特征进行分析,设计出一个基于特征匹配的入侵检测系统,采用了高效的BM(Boyer-Moore)串匹配算法,实现实时检测入侵攻击,并及时地采取保护措施,阻止入侵危害事态的进一步扩大,这对网络安全发展具有重要的现实意义。本文的主要工作包括：1、介绍了基于特征匹配功能的入侵检测系统的研究现状和意义；2、研究了如何获取描述网络入侵行为特征的数据以及如何利用特征数据精确判断入侵行为的性质；3、对几种特征匹配算法进行深入的分析,提出了基于BM(Boyer-Moore)串匹配算法的入侵检测系统的设计方法；4、在需求分析、系统设计基础上,在Fedora-Liunx-9平台下用C语言实现该入侵检测系统。系统利用Glade和GTK+开发表示层,系统的入侵特征库没有采用数据库实现,而是简单地采用文件模拟实现。程序实现效果分两部分：一是通过前台向文件添加特征；二是检测到入侵行为,并启动防火墙阻断与入侵者的通信。更多还原

【Abstract】 With the rapid development of network technology, the phenomenon of spread of computer viruses and network intrusion attacks also occurs frequently, Malicious attackers on the network are also increasing, which makes the importance of network security become more apparent. But traditional security defense mechanism mainly makes use of safety treasures of information encryption, identity verification, access control, security router, firewall and visual private network etc. to protect computer system and network infrastructure. Once the intruders make use of vulnerable program or system vulnerabilities bypass these security treasures, they can gain unauthorized access to host and cause the system to collapse and losses. Relying solely on traditional static security technologies such as firewalls, data encryption, and authentication is difficult to guarantee the security of the network. Then, the intrusion detection as a new generation of security assurances technology appears, which can provide dynamic security protection for hosts and networks. It can not only detect the intrusion from outside, but also it can provide effective supervision on illegal communication.Intrusion detection system can find unauthorized or malicious network behavior, illegal and legal behavior can be distinguished that is prerequisite, and that is to say, the nature can be analyzed by extracting the pattern features. In this thesis author designs an intrusion detection system based on pattern matching, which uses efficient BM (Boyer-Moore) string matching algorithm, achieves real-time detection to intrusion and takes protective measures in a timely manner, thus, to prevent intrusion hazards events to further expand, which has a very important practical significance to the development of network security.The main work is summarized as follows:1. Introduction of significance and the current state of research into an intrusion detection system based on pattern matching. 2. Research on what how to get the data descripting of network intrusion behavior characteristics and how to use the feature data accurately judging the nature of the intrusion behavior.3. Careful and further analysis of the features of pattern matching algorithm and designing methods of the system of intrusion detection.4. Realization by using C-language under the Fedora-Liunx-9based on requirement analysis, system design.The program’s graphical interface is designed with Glade and GTK+. System intrusion signature doesn’t use database implementation, but simply uses the file simulation. Ultimately, the effect of the program is divided into two parts:One is to add features to the file through the front; Second is to detect the intrusion, and start the firewall to block communication with the intruders.更多还原