Linux下入侵检测系统的设计与实现  

Design and Implementation of Intrusion Detection System Based on Linux

作　　者：盛文婷[1] 刘文[1,2] 王炜[3] 李智[1] 樊伟宏[1] 

机构地区：[1]新疆农业大学科学技术学院,乌鲁木齐830091 [2]新疆机电职业技术学院电气工程系,乌鲁木齐830011 [3]新疆石油管理局明园职工医院药械科,乌鲁木齐830000

出　　处：《现代计算机（中旬刊）》2012年第9期73-77,共5页Modern Computer

基　　金：新疆维吾尔自治区高校科研计划(No.XJEDU2010S48)

摘　　要：研究Linux下基于Snort的入侵检测系统的搭建和使用方法,分析系统的总体构架和工作流程,实现Linux平台下入侵检测系统中网络数据包捕获、网络协议分析、存储等功能。利用Libpcap函数库实现了Linux下网络数据包的捕获技术;利用MySQL数据库实现存储网络数据功能;利用BASE实现了友好的、操作简单的图形化用户界面。通过测试,在Linux环境下构建的Snort系统能实现实时流量分析、日志存储、协议分析、对内容进行搜索匹配等功能,能够检测不同种类的攻击方式,并对攻击进行实时报警,为构建入侵检测系统提供借鉴。Studies the construction and use of methods based on the Snort intrusion detection system, analyzes the overall system architecture and workflow, realizes the network packet capture, intrusion detection systems, network protocol analysis, storage and other functions based on Linux platform. Realizes the Linux network packet capture technology with Libpcap library, and storage network data function with MySQL database, the GUI with the BASE. The test shows that the Snort can achieves the function of real-time traffic analysis, log storage, protocol analysis, searching for matching content, and can detect different kinds of attack and realize real-time warning, and this provides a reference for building the intrusion detection system.

关 键 词：LINUX 入侵检测系统 网络安全 SNORT 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论]