基于windows入侵檢測系統(tǒng)的研究與設(shè)計(jì)——響應(yīng)模塊設(shè)計(jì)

論文字?jǐn)?shù):16433,頁數(shù):31

摘    要
入侵檢測技術(shù)是對傳統(tǒng)的安全技術(shù)（如防火墻）的合理補(bǔ)充。它通過監(jiān)視主機(jī)系統(tǒng)或網(wǎng)絡(luò)，能夠?qū)�惡意或危害�?jì)算機(jī)資源的行為進(jìn)行識別和響應(yīng)。通過與其它的安全產(chǎn)品的聯(lián)動，還可以實(shí)現(xiàn)對入侵的有效阻止。入侵檢測系統(tǒng)的研究和實(shí)現(xiàn)已經(jīng)成為當(dāng)前網(wǎng)絡(luò)安全的重要課題。
本文從研究入侵技術(shù)入手，分析了入侵過程的各個(gè)階段、各種入侵方法，總結(jié)了網(wǎng)絡(luò)安全事故的根源。然后，介紹了入侵檢測方法的分類，分析了各種入侵檢測方法和字符串匹配的算法。研究表明基于規(guī)則的入侵檢測系統(tǒng)是現(xiàn)在入侵檢測系統(tǒng)設(shè)計(jì)的最主要的技術(shù)，基于這一理論，設(shè)計(jì)開發(fā)了一個(gè)基于規(guī)則匹配的特征檢測方法的響應(yīng)模塊。系統(tǒng)開發(fā)環(huán)境為VC++ 6.0，數(shù)據(jù)庫采用MYSQL數(shù)據(jù)庫。通過該系統(tǒng)可以有效的實(shí)現(xiàn)對入侵的檢測，并且具有用戶友好性。

關(guān)鍵詞:  入侵檢測；響應(yīng)模塊；規(guī)則匹配
The Research and Design of Intrusion Detection System
Based on Windows
——Design of Response Module

Abstract
The intrusion detection technology is complementarities for traditional security protecting technology, such as firewalls. It can identify and response to malice activities by monitoring the host system or the Internet. It also can prevent intrusion activities with the linkage of other security technology. The research and development of IDS has become the important subject about network security.
This thesis begins with studying attacking technology, including analyzing every stage of an intrusion stage and various attacking methods, summarizing the fundamental reasons of various network security incidents and the trend of attacking technology, afterwards, introducing the classification of the intrusion detection system, analyzing various intrusion detection methods and string-matching algorithm.  Through research to make clear that the intrusion detection system based on rules is the most important intrusion detection technology, because of this theory, the design has developed a response module based on the rule match characteristic examination method. The system development environment is VC++ 6.0; the database adapts the MYSQL database. This system can implement the effective realization to the intrusion detection, and the interface of this software is friendly.

Key words: Intrusion detection; Response module; Rule-matching

目   錄

1 引  言 1
1.1 背景 1
1.2 國內(nèi)外研究現(xiàn)狀 1
1.3 本文的主要工作 1
2 理論基礎(chǔ) 1
2.1 入侵基本概念 2
2.1.1 安全與入侵的概念 2
2.1.2 入侵的步驟 2
2.1.3 黑客攻擊的方法 3
2.1.4 安全威脅的根源 6
2.2 入侵檢測技術(shù) 6
2.2.1 入侵檢測的概念 6
2.2.2 入侵檢測系統(tǒng)的基本結(jié)構(gòu)構(gòu)成 7
2.2.3 入侵檢測的分類 7
2.2.4 入侵檢測方法 9
2.3 BM算法 11
3 系統(tǒng)總體設(shè)計(jì) 13
3.1 系統(tǒng)概述 13
3.2 系統(tǒng)總體結(jié)構(gòu)框架 13
3.3 開發(fā)環(huán)境 14
4 響應(yīng)模塊設(shè)計(jì)實(shí)現(xiàn) 14
4.1 規(guī)則庫設(shè)計(jì)實(shí)現(xiàn) 14
4.2 事件分析設(shè)計(jì)與實(shí)現(xiàn) 17
4.2.1 規(guī)則解析 17
4.2.2 規(guī)則匹配流程 18
4.3 輸出模塊的設(shè)計(jì) 19
4.3.1 響應(yīng)輸出流程 19
4.3.2 日志數(shù)據(jù)庫設(shè)計(jì) 20
4.4 模塊集成實(shí)現(xiàn) 20
5 系統(tǒng)測試和分析 21
5.1 攻擊檢測測試 21
5.1.1 測試目的 21
5.1.2 測試過程 21
5.1.3 測試結(jié)果分析 21
5.2 誤報(bào)和漏報(bào)測試 22
5.2.1 測試目的 22
5.2.2 測試過程 22
5.2.3 測試結(jié)果分析 23
結(jié)    論 23
參考文獻(xiàn) 24
致    謝 25
聲    明 26