基于SNMP的主动入侵检测系统的设计与实现  

Design and implementation of active intrusion detection system based on SNMP

作　　者：耿震华[1] 侯彬彬[1] 陆菊康[1] 

机构地区：[1]上海大学计算机工程与科学学院,上海200072

出　　处：《计算机工程与设计》2006年第22期4343-4346,共4页Computer Engineering and Design

摘　　要：针对当前入侵检测系统中响应的被动性、滞后性问题,结合网络管理思想和包过滤防火墙技术,提出了一种分布式主动响应的入侵检测系统(SNMP_AIDS)的结构并给出了该系统的体系结构图。然后设计了系统中的3大部件:入侵检测系统(intrusion detection systemI,DS)群集、中央事件管理器、防火墙代理模块,并对这3大部件的功能和特点进行了分析。最后,在对系统进行详细设计之后,又给出了系统中3大部件的原型实现。该系统经过实验证明了其主动响应能力,并能向防火墙发出简单网络管理协议(simple network management protocol,SNMP)报文。Based on the administration of networks and the thinking of the packet filtering firewall, a distributed framework and an archi- tecture graph for SNMP_AIDS that can response actively which aims at how to improve the lag of detection is presented. SNMP_AIDS is divided into three parts： The IDS group, the center managers and the firewall agent. A detailed function and characteristic description of the three parts are also presented. After the detailed design, a prototype is presented at last. The active response ability of the system is tested by the experiment that can send SNMP message to the firewall.

关 键 词：入侵检测系统 主动响应 简单网络管理协议 包过滤防火墙 IDMEF 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]