基于Snort的入侵防御系统的设计与实现

发布时间：2018-07-01 16:33

本文选题：入侵防御系统 + 入侵检测系统　；参考：《西安电子科技大学》2016年硕士论文

【摘要】：随着网络技术的快速发展,网络环境日新月异,网络给大众所提供的服务越来越多,人们对于网络的依赖也越来越严重。与网络技术相对应,黑客攻击技术也在快速的发展。伴随网络普及的同时,用户被攻击事件也在不断地增长。不只是普通用户,越来越多的黑客把自己的攻击目标锁定为政府机构、社会团体甚至是各国军方的机密文件。于是网络安全的发展,被越来越多的人们所关注。各国政府也在这方面投入了大量的人力和资本,以求维护本国网络的安全,使本国的机密文件可以处于安全的环境中。由于杭州华三通信技术有限公司(H3C)的主营业务是为各个高校和企业网络的搭建提供相应的设备,因此在现如今的网络环境下,公司对于其产品在网络安全方面的功能也提出了相应的要求,于是决定开发自己的入侵防御系统(Intrusion Prevention System,IPS)。由于以前没有这方面的设计,所以主要将会面临以下三个问题:1、已有的IPS产品与公司的产品不兼容,无法直接使用,因此需要进行移植;2、已有的IPS大多数是应用层的,效率比较低,需要进行改进;3、IPS内部算法效率低,需要进行改进;为了解决以上问题,本文通过对国内外IPS发展现状的了解,结合H3C公司产品的需求以及需要部署网络的环境等方面内容的研究,设计实现了一个基于Snort的IPS。主要完成了以下三个方面:1、通过对IPS发展过程的研究,选定了将要进行移植的系统——Snort系统。这是一款入侵检测系统(Intrusion Detection System,IDS),IDS是IPS的基础,也是IPS的核心部分。Snort系统是世界上最广泛使用的一种IDS,具有高效、灵活和简洁的特点。作为开源系统,使用该系统进行移植,也可以降低开发成本。2、为了提高IPS的效率,也为了满足公司产品的需求,对Snort系统进行了改进,从原来的用户层面修改到了内核层面,因此对Snort的一些模块进行了修改,并增加了新的模块。3、对于内部算法效率低的问题,引入了多模式匹配算法,通过该算法可以只用一次比较,就得出某一字符串中是否包含另外几种字符串,大大的提高了对于报文进行比对的效率。本文通过对基于Snort的IPS进行需求分析,了解到系统需要实现的各个功能点。然后针对各个功能点,结合Snort系统,对IPS进行模块划分和设计,并实现了各个模块。最后搭建环境对各个功能点进行了详细的测试,修改了测试中出现的错误,保证最后的系统可以实现需求中全部的功能。
[Abstract]:With the rapid development of network technology, the network environment changes with each passing day, the network provides more and more services to the public, and people rely more and more on the network. Corresponding to network technology, hacker attack technology is also developing rapidly. With the popularity of the network, user attacks are also growing. More and more hackers are targeting government agencies, social groups and even the military's classified documents, not just ordinary users. Therefore, the development of network security is concerned by more and more people. Governments have also invested a great deal of manpower and capital in this area in order to maintain the security of their own networks so that their confidential documents can be kept in a secure environment. Since the main business of Hangzhou Huasan Communication Technology Co., Ltd. (H3C) is to provide corresponding equipment for the construction of various universities and enterprises' networks, so in today's network environment, The company has put forward the corresponding requirements for the function of its products in network security, so it has decided to develop its own intrusion Prevention system (IPS). Since there was no such design in the past, the following three major problems will be faced: 1. Existing IPS products are incompatible with the company's products and cannot be used directly, so we need to transplant them. Most of the existing IPS products are in the application layer. In order to solve the above problems, this paper is based on the understanding of the current situation of IPS development at home and abroad. Considering the requirements of H3C products and the research of the environment which needs to deploy the network, a snort-based IPSs is designed and implemented. The following three aspects: 1: 1 are completed. Through the research on the development process of IPS, the snort system which will be transplanted is selected. This is an intrusion Detection system (IDS). IDS is the foundation of IPS, and also the core part of IPS. Snort system is the most widely used IDSs in the world. It has the characteristics of high efficiency, flexibility and simplicity. As an open source system, using this system to transplant can also reduce the development cost. In order to improve the efficiency of IPS and meet the requirements of the company's products, snort system has been improved from the original user level to the kernel level. Therefore, some modules of snort are modified, and a new module .3 is added. For the problem of low efficiency of internal algorithm, a multi-pattern matching algorithm is introduced, which can be compared only once. Whether a string contains several other strings greatly improves the efficiency of message alignment. By analyzing the requirements of snort-based IPS, this paper finds out the functional points that the system needs to implement. Then according to each function point, combined with snort system, the IPS module is divided and designed, and each module is realized. Finally, the environment is built to test each function point in detail, and the errors in the test are modified to ensure that the final system can realize all the functions in the requirement.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】