模式匹配与校验和相结合的IP协议识别方法  

IP protocol identification method using the pattern match and check sum

作　　者：杨洁[1] 刘聪锋[2] 

机构地区：[1]西安邮电学院通信与信息工程学院,陕西西安710121 [2]西安电子科技大学电子对抗研究所,陕西西安710071

出　　处：《西安电子科技大学学报》2012年第3期149-153,165,共6页Journal of Xidian University

基　　金：国家自然科学基金资助项目(61072107);陕西省教育厅自然科学类专项科研计划资助项目(11JK1014);中央高校基本科研业务费专项资金资助项目(JY10000902025);博士后基金资助项目(20090451251);陕西省工业攻关资助项目(2009K08-31)

摘　　要：为了减少入侵检测系统中误报和漏报的发生概率,提高对应用层协议进行详细分析的准确率,针对以太网数据包提出了一种将模式匹配算法和IP校验和计算相结合的IP协议识别方法.该方法首先根据IP报头的静态特征对以太数据包进行模式匹配,再结合报头校验和计算来识别该数据包所属类型是否为IP协议.通过在Visual C++软件环境下运行基于给定数据样本的仿真程序,验证了该方法的正确性和可靠性,从而为上层协议的识别提供了理论基础和识别算法.In order to reduce the probability of report mistakes and pretermission which is likely to happen, ＇and to improve the nicety of explicating application-level protocols in an intrusion detection system, a method is proposed to identify the IP protocol using the pattern match algorithm and IP header check sum calculation for Ethernet data packs. Firstly, Ethernet data packs are matched with some static characters of the IP header in the proposed method, and then IP protocol check sum calculation is done. As a result, whether the type that the data packs belong to is IP protocol or not can he identified finally. Under the Visual C＋＋ software condition, simulations prove the validity and reliability of the proposed method by running the simulated programme based on the data swatch which has been listed. And so the correctness of identifying upper protocols in the future is able to be ensured.

关 键 词：入侵检测 IP协议识别 模式匹配 校验和 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]