基于CIDF的网络入侵检测系统设计与实现  

DESIGN AND IMPLEMENTATION OF NIDS BASED ON CIDF

作　　者：常佶[1] 陈志坚[1] 

机构地区：[1]内蒙古工业大学信息工程学院,呼和浩特010051

出　　处：《内蒙古工业大学学报（自然科学版）》2006年第2期90-96,共7页Journal of Inner Mongolia University of Technology：Natural Science Edition

摘　　要：文中设计并实现了在L inux平台上基于C IDF框架的网络入侵检测系统,采用了异常和误用相结合的检测技术.实现了基于L ibpcap的网络数据包的捕获,在对入侵行为特征进行分析的基础上定义了入侵规则库,利用规则解析模块实现了入侵规则解析.经过测试,本系统能够准确检测出端口扫描、T rinoo攻击、CG I扫描.A network intrusion detection system based on CIDF in Redhat Linux has been designed and implemented. This NIDS can be applied to both misuse intrusion detection and abnormal intrusion detection. Packet capture is realized with Lipcap. Intrusion behaviors are analyzed. Based on the analysis, an intrusion signature database is defined. A rule analysis module is used to analyze the rule of intrusion. Through testing, it is proved that, with the help of this NIDS, the port scan, Trinoo attack and CGI scan can all be detected.

关 键 词：网络入侵检测系统(NIDS) 通用入侵检测框架(CIDS) 端口扫描 

分 类 号：TP206.1[自动化与计算机技术—检测技术与自动化装置]