预处理插件在IPv6入侵检测系统中的应用  

Application of Preprocessor Plug-in to IPv6 Intrusion Detection System

作　　者：张宏[1] 龙春[1] 葛敬国[1] 李俊[1] 

机构地区：[1]中国科学院计算机网络信息中心,北京100190

出　　处：《计算机系统应用》2012年第9期32-37,共6页Computer Systems & Applications

摘　　要：Snort是一个功能强大的轻量级NIDS,它能够检测出各种不同的攻击方式,并能对攻击进行实时告警.针对Snort没有提供对IPv6地址前缀攻击检测支持的问题,提出利用预处理插件检测该类攻击的解决方案,给出了插件的检测流程.实验结果表明,该插件对地址前缀欺骗攻击具有较高的检测率,是一种有效的入侵检测系统插件.Snort is one of a light wight, powerful NIDS. It can detect many different kinds of attack behaviors, and give real-time alerts. Because Snort does not support the detection of IPv6 address prefix spoofing, this paper supplies a solution to implement the intrusion detection preprocessor plug-in and provides the detection process. The experimental result proves that the preprocessor has a higher detection ratio to the spoof of IPv6 address prefix, and it is an effective plug-in on the intrusion detection system.

关 键 词：预处理插件 IPV6网络 地址前缀 SNORT入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]