局域网入侵检测系统的研究

发布时间：2018-08-07 11:47

【摘要】：随着计算机网络应用的迅猛发展，局域网的安全也是当前各部门面临的一个主要问题，本文研究了企业局域网入侵检测系统，为网络安全提供保障。入侵检测系统(Intrusion Detection System, IDS)是一门新兴的技术，，它是一种主动的防御技术，入侵检测系统是防火墙的重要补充，其基本功能是监视内部和外部网络的流量，并对检测到的攻击特征或异常行为进行报警，同时监视网络对防火墙和其它主机的攻击。本文通过对网络入侵信息的来源、入侵信息的分类加以分析和研究，实现了对系统资源的非授权使用做出及时的判断、记录和报警。在此基础上，本文深入研究了基于Snort的入侵检测系统，对Snort的模块结构、模块功能进行规则解析和规则匹配，并对入侵检测系统的流程进行了解析。为了提高效率，本文在保障准确性的情况下，通过增大了BM算法中字符匹配时的偏移量，降低了比较的次数和系统匹配所需的时间。改进了入侵检测系统的Snort检测引擎采用的单模BM匹配算法，使入侵检测系统工作效率大大的提高。实验综合数据表明，改进后的算法在字符串匹配速度方面比原来BM算法平均提高5%-10%，有效缩短了比较次数和时间，加大了模式串的移动距离，明显提高了入侵检测系统的检测效率。
[Abstract]:With the rapid development of computer network application, the security of local area network is also a main problem that each department faces at present. This paper studies the intrusion detection system of enterprise local area network to provide the guarantee for network security. Intrusion Detection system (Intrusion Detection System, IDS) is a new technology. It is an active defense technology. Intrusion Detection system (IDS) is an important supplement to firewall. Its basic function is to monitor the internal and external network traffic. The detected attack features or abnormal behaviors are alerted and the network attacks on firewalls and other hosts are monitored. Through the analysis and research on the source and classification of network intrusion information, this paper realizes the timely judgment, recording and alarming of the unauthorized use of system resources. On this basis, the intrusion detection system based on Snort is studied in this paper. The module structure and function of Snort are analyzed and the rules are matched, and the flow of the intrusion detection system is analyzed. In order to improve the efficiency, this paper reduces the number of comparisons and the time required for system matching by increasing the offset of character matching in BM algorithm under the condition of ensuring accuracy. The single mode BM matching algorithm used in the Snort detection engine of the intrusion detection system is improved, and the work efficiency of the intrusion detection system is greatly improved. The experimental data show that the improved algorithm increases the average speed of string matching by 5-10 than that of the original BM algorithm, effectively shortens the number and time of comparison, and increases the moving distance of pattern strings. The detection efficiency of intrusion detection system is improved obviously.
【学位授予单位】：天津大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08;TP393.1

【相似文献】