基于Snort规则的双阶段数据包过滤算法

发布时间：2018-05-02 04:43

本文选题：深包检测 + Snort规则　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：近年来,随着互联网的迅速发展,网络安全问题得到了社会的广泛关注。网络攻击形式日趋复杂,入侵检测系统作为传统网络防火墙的补充,在网络安全方面不断发挥越来越重要的作用。目前,深包检测(DPI)技术是网络入侵检测用到的一项主要技术,该技术不仅检查数据包的头部,而且会对其携带的内容进行分析。最常见的深度包检测方案是基于过滤规则的,在这类方案中,专家首先分析各种类型的有害数据包,发现它们的共有关键特征,然后以文本或正则表达式的方式描述些这特征,最后将一类有害数据包的特征编写为一条过滤规则,多条过滤规则构成规则集,DPI系统将依据这些规则对数据包进行检测。Snort是一款非常成功的入侵检测系统。利用Snort规则集对数据包检测时,传统做法是将捕获到的每一个数据包与所有规则进行比对,但是随着规则数量的增多,这样的数据包过滤策略已经不能满足效率上的要求。目前比较实用的做法是将Snort规则与自动机相结合,本文提出了一套完整的Snort规则处理流程,并给出了数据包的过滤方案。在对Snort规则处理时,首先将所有规则编译成一组DFA,然后从每个DFA中提取出一些“关键特征”。对数据包过滤时,首先将数据包与这些关键特征进行预过滤,通过预过滤判断是否需要与DFA进行精确过滤。通过预过滤可以将网络中大部分安全的数据包放行,这些数据包不再需要与DFA进行精确过滤,大大提高了过滤效率。本文主要研究了以下几个方面的问题:(1)分析Snort规则,建立Snort规则选项模型,将需要处理的选项统一转化为PCRE,然后进一步编译成DFA。(2)针对一些DFA无法提取出充足的“关键特征”的情况下,研究如何降低这些DFA在预过滤阶段的命中率。(3)为了进一步提高过滤效率,实现数据包预过滤和精确过滤的并行化。
[Abstract]:In recent years, with the rapid development of the Internet, the network security problem has been widely concerned. The form of network attack is becoming more and more complex. As a supplement to the traditional network firewall, intrusion detection system is playing a more and more important role in the network security. At present, the deep packet detection (DPI) technology is the one used in network intrusion detection. The technology not only checks the head of the packet, but also analyzes the contents of the packet. The most common depth packet detection scheme is based on the filtering rules. In this kind of scheme, experts first analyze various types of harmful packets, find their common key features, and then use the text or regular expression side. The features are described. Finally, the characteristics of a class of harmful data packets are written as a filter rule, and multiple filtering rules constitute a rule set. The DPI system detects the packets based on these rules..Snort is a very successful intrusion detection system. Using the Snort rule set to detect packets, the traditional method will be captured by the traditional method. Each packet is compared with all the rules, but as the number of rules increases, such a packet filtering strategy can not meet the requirements of efficiency. At present, a more practical method is to combine Snort rules with automata. This paper presents a complete set of Snort rules processing flow, and gives the filtering of data packets. In the process of processing Snort rules, all the rules are compiled into a group of DFA first, and then some "key features" are extracted from each DFA. Most secure packets are released, and these packets no longer need to be filtered accurately with DFA, which greatly improves the filtering efficiency. This paper mainly studies the following aspects: (1) analyzing Snort rules, establishing the Snort rule option model, converting the selected option one to PCRE, and then further compiling to DFA. (2) for one When some DFA can not extract sufficient "key features", we study how to reduce the hit rate of these DFA in the pre filtering stage. (3) in order to further improve the filtering efficiency, the parallelization of packet pre filtering and accurate filtering can be realized.

【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】