IDS規(guī)則匹配算法的改進(jìn)與實(shí)現(xiàn)

論文字?jǐn)?shù):20602,頁(yè)數(shù):57  有開(kāi)題報(bào)告，任務(wù)書(shū)

摘    要

 隨著網(wǎng)絡(luò)技術(shù)的飛速發(fā)展，計(jì)算機(jī)網(wǎng)絡(luò)在社會(huì)、經(jīng)濟(jì)、文化及人們的日常生活中扮演著越來(lái)越重要的角色。人們?cè)谑褂糜?jì)算機(jī)網(wǎng)絡(luò)的同時(shí)，也深深的感受到網(wǎng)絡(luò)安全的重要性。入侵檢測(cè)正是網(wǎng)絡(luò)安全的一個(gè)重要的守衛(wèi)士。對(duì)入侵檢測(cè)根據(jù)其所采用的方法可以分為：誤用檢測(cè)，異常檢測(cè)和基于規(guī)范的檢測(cè)。
 Snort是一個(gè)開(kāi)放源碼的網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)（NIDS），它采用誤用檢測(cè)的方法，具有很強(qiáng)的告警能力，然而Snort在規(guī)則匹配方面仍存在缺陷，特別是在高速網(wǎng)絡(luò)連接下，Snort的規(guī)則匹配算法匹配效率較低。因此本文對(duì)誤用檢測(cè)中的規(guī)則匹配算法進(jìn)行了研究與改進(jìn)，結(jié)合動(dòng)態(tài)規(guī)則匹配技術(shù)，改進(jìn)規(guī)則匹配算法，使得Snort的檢測(cè)效率得到提高。
 本文對(duì)改進(jìn)前后的算法做了對(duì)比實(shí)驗(yàn)。首先，采用Snort入侵檢測(cè)模型和改進(jìn)前的算法，構(gòu)建一個(gè)入侵檢測(cè)系統(tǒng)，進(jìn)行實(shí)驗(yàn)并得到相應(yīng)的實(shí)驗(yàn)結(jié)果；然后，使用改進(jìn)后的算法，將Snort的規(guī)則庫(kù)內(nèi)容進(jìn)行動(dòng)態(tài)排序后，進(jìn)行實(shí)驗(yàn)，并將實(shí)驗(yàn)結(jié)果與改進(jìn)前進(jìn)行比較。對(duì)比分析結(jié)果表明，改進(jìn)后的算法提高了檢測(cè)效率。
 
關(guān)鍵字:規(guī)則匹配；規(guī)則庫(kù)；動(dòng)態(tài)匹配
The Implementation　And Improvement
Of IDS Rule-matching Algorithm

ABSTRACT
 With the rapid development of Internet, computer network has become much more important in many areas, namely, society, economics, culture, and the people's ordinary lives. People is also deeply feel the importance of network security when they use computer networks, Intrusion Detection Network security is an important guard . According to the detection methods of IDS, we can divide IDS into three types: misuse detection ,anomaly detection and standardized detection.
 Snort is an open source network intrusion detection system (NIDS),which use the misuse detection methods and has a strong warning capability, However Snort have some disadvantage in many respects, Especially in the case of the high-speed network link, the rules matching algorithm of Snort is less efficient. Therefore ,we use dynamic rule-matching technology and make some research in order to make some improvements in the detection efficiency.
 In this paper, we make two experiments, one experiment we use the Original algorithm, the other we use the improved algorithm. This paper use Snort Intrusion Detection model, built an intrusion detection system in order to do intrusion detection experiments. Then the rules will be adjusted dynamically by algorithm, continue to do experiments, the results will be compared with before, thus proving that the system improved the detection efficiency. Then, conclude the results of this experiment.
 
 Keywords: IDS; rules matching; rules lab; dynamic matching

目 錄
1 緒論 1
1.1 入侵檢測(cè)系統(tǒng)的起源 1
1.2 入侵檢測(cè)系統(tǒng)的現(xiàn)狀 1
1.2.1 國(guó)外IDS現(xiàn)狀 2
1.3 入侵檢測(cè)系統(tǒng)的分類(lèi) 3
1.3.1 國(guó)內(nèi)IDS產(chǎn)品 5
1.3.2 國(guó)外IDS產(chǎn)品介紹 6
1.4 IDS的體系結(jié)構(gòu) 6
1.5 入侵檢測(cè)系統(tǒng)的發(fā)展方向 7
1.6 本文所做的工作 8
2 Snort的研究 9
2.1 Snort的規(guī)則 9
2.2 Snort匹配算法解析 13
2.3 Snort 命令介紹 14
2.4 Snort的工作模式 16
3 規(guī)則匹配算法 19
3.1 BMH算法 19
3.2 KMP匹配算法 20
3.3 BM算法 22
4 Snort規(guī)則匹配算法的改進(jìn) 24
4.1 引言 24
4.2 算法改進(jìn)目的 24
4.3 算法改進(jìn)思想 24
4.4 改進(jìn)后的Snort規(guī)則機(jī)制 25
4.5 改進(jìn)后的Snort模塊圖 26
5 Snort實(shí)驗(yàn) 28
5.1 實(shí)驗(yàn)一: Snort的調(diào)試實(shí)驗(yàn) 28
5.1.1 實(shí)驗(yàn)設(shè)備 28
5.1.2 實(shí)驗(yàn)?zāi)康?nbsp;28
5.1.3 平臺(tái)搭建 28
5.1.4 實(shí)驗(yàn)方案 40
5.1.5 Snort運(yùn)行頁(yè)面 40
5.1.6 實(shí)驗(yàn)結(jié)果 42
5.2 實(shí)驗(yàn)二: Snort的改進(jìn)實(shí)驗(yàn) 42
5.2.1 實(shí)驗(yàn)設(shè)備 42
5.2.2 實(shí)驗(yàn)?zāi)康?nbsp;43
5.2.3 實(shí)驗(yàn)方案 43
5.2.4 實(shí)驗(yàn)結(jié)果 43
5.3 結(jié)論 43
6 總結(jié)和展望 45
致謝 46
參考文獻(xiàn) 47
附錄 49