针对IP分片攻击的IDS反欺骗技术研究  

RESEARCH ON THE TECHNIQUE OF IDS ANTI-DECEIT AIMING AT IP FRAGMENT ATTACK

作　　者：周明春[1] 杨树堂[1] 

机构地区：[1]上海交通大学电子工程系,上海200030

出　　处：《计算机应用与软件》2007年第10期22-25,共4页Computer Applications and Software

基　　金：国家863项目(2005AA145110)。

摘　　要：针对当前入侵检测系统(IDS)在处理IP分片时存在易被欺骗的问题,提出一种应对这类攻击的反欺骗方案。通过在IDS前端加入一个预分析器,对捕获的数据包进行分析,预测信息源端的行为特征,从而有效识别IDS欺骗行为。测试表明,采用这种方案能有效检测出针对IDS实施的分片期骗攻击。Current Intrusion Detection System （IDS） is easy to be deceived when dealing with IP fragments. An IDS anti-deceit method is put forward to solve the problem of IP fragment attacks. The IDS with a pre-analyzer added can distinguish IDS deceit based on the analysis of the captured fragments and the prediction of the behavior character of the information source end. Tests and experiments show that the technigve can detect the IDS deceit based on IP fragments effectively.

关 键 词：入侵检测系统 分片重组 预分析器 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]