互联网应急中心内网安全终端套件的开发

发布时间：2018-06-24 18:14

本文选题：流量监控 + 协议分析　；参考：《南京邮电大学》2014年硕士论文

【摘要】：当前，互联网的发展日新月异，互联网已不仅仅是指使PC机之间互联互通的网络代名词，它还包含了与移动终端的互联互通（移动互联网），以及与传感器网的互联互通（物联网）。然而，伴随着各种业务与应用逐步充斥着整个互联网，网络安全问题也随之而来，毫不夸张的讲，哪儿有网络，哪儿就有网络安全问题。本文讨论的内网安全终端系统旨在对现有病毒/木马/内容监测系统的诸多不足形成有效补充。首先，，本文对网络安全、网络数据包捕获技术/捕获机制及入侵检测的相关理论进行了深入研究，并通过认真分析，确定了本文研究的理论基础。其次，本文给出了内网安全终端系统的体系结构与详细设计，内容包括：一、设计数据包分析模块，讨论了TCP/IP协议簇的分层结构，主要的协议类型以及各协议的首部格式，并对各协议的首部格式进行了结构化定义。二、设计数据包捕获模块，讨论了BPF的网络数据包过滤机制，并讨论了如何利用Libpcap开发包来捕获需求的网络数据包。三、设计数据包存储模块，讨论了数据包存储的工作流程与形式。四、设计数据包入侵检测模块，讨论了如何利用Libnids开发包检测端口扫描攻击以及基于TCP/UDP数据流重组的敏感文本分析流程。最后，本文对设计的系统进行了测试，验证其取得了预期的效果。之后对完成的工作进行总结，并对下一步的工作进行展望。
[Abstract]:At present, with the rapid development of the Internet, the Internet has become more than just a synonym for the interconnection of PC computers. It also includes interconnection with mobile terminals (mobile Internet) and with sensor networks (Internet of things). However, with all kinds of business and applications gradually flooding the entire Internet, network security issues followed, no exaggeration, where there is network, where there is network security problems. The intranet security terminal system discussed in this paper aims to effectively supplement the shortcomings of the existing virus / Trojan / content monitoring system. Firstly, this paper makes a deep research on network security, network packet capture technology / capture mechanism and the related theories of intrusion detection, and through careful analysis, determines the theoretical basis of this study. Secondly, this paper gives the architecture and detailed design of the intranet security terminal system. The main contents are as follows: first, the packet analysis module is designed, and the hierarchical structure of TCP / IP protocol cluster is discussed. The main protocol types and the first format of each protocol are defined structurally. Secondly, we design a packet capture module, discuss the network packet filtering mechanism of BPF, and discuss how to use Libpcap development package to capture the required network data packet. Thirdly, the data packet storage module is designed, and the workflow and form of data packet storage are discussed. Fourthly, we design a packet intrusion detection module, and discuss how to use Libnids development kit to detect the port scan attack and the sensitive text analysis process based on TCP / UDP data stream recombination. Finally, the system is tested to verify that it has achieved the desired results. After that, the work is summarized and the future work is prospected.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】