基于Snort规则优化的IPv6入侵检测系统  

IPv6 Intrusion Detection System Based on Snort Rules Optimization

作　　者：张宏[1] 龙春[1] 葛敬国[1] 

机构地区：[1]中国科学院计算机网络信息中心,北京100190

出　　处：《科研信息化技术与应用》2012年第3期12-19,共8页E-science Technology & Application

基　　金：国家发改委<基于CNGI的科研信息基础设施建设和应用示范工程>(发改办高技(2010)1634号)

摘　　要：分析了基于特征的Snort入侵检测系统,并在此基础上实现了Snort向IPv6网络环境的移植。为了提高入侵检测系统中检测引擎的速度和效率,在分析Snort的规则组织结构和规则匹配过程的基础上,提出了一种IPv6动态规则匹配机制。按照特征参数和共同选项来进一步划分规则,为规则选项关联快表项,对规则匹配的顺序进行动态调整,从而提高了规则匹配速度。实验结果表明,该系统可有效地检测IPv6各种攻击,平均规则匹配速度提高了约19.2%。Snort intrusion detection system based on features is analyzed. And based on this, the porting of Snort system into IPv6 network environments is implemented. To improve the speed and efficiency of intrusion detection engine in an intrusion detection system, the organizational structure and rules matching process of Snort are analyzed, and a dynamic rule matching mechanism for IPv6 is introduced. In order to adjust the sequence of rule matching dynamically and to improve the efficiency of rule matching, the rules of Snort rule option according to eigenvalue and common items are classified and a chain of fast item is associated with the rule option. The experiment shows that the system not only detects kinds of attacking for IPv6, but also increases average rule matching speed about 19.2%.

关 键 词：网络安全 入侵检测 规则匹配 IPV6协议 

分 类 号：G623.58[文化科学—教育学]