基于Snort入侵检测系统的改进优化  

An Improved Intrusion Detection System Based on Snort

作　　者：杨海峰[1] 陈明锐[1] 

机构地区：[1]海南大学信息科学技术学院,海南海口570228

出　　处：《海南大学学报（自然科学版）》2012年第4期360-364,共5页Natural Science Journal of Hainan University

基　　金：海口市重点项目(2009-038)

摘　　要：在深入研究和分析Snort入侵检测系统的基础上,对原有系统提出了新的改进设计方案,解决了Snort系统不能及时检测未知入侵行为的问题.同时,根据Snort流出数据的特征,统计了其出现频率,将存在威胁的数据特征动态加入到Snort异常特征库中,实现了对未知入侵的拦截.改进后的系统可有效防止未知的入侵事件,降低了丢包率,提高了系统的全面检测能力.Based on the analysis of the Snort intrusion detection system, a new improved scheme was put forward to solve the problem that Snort system can＇ t detect unknown intrusion events timely. According to the characteristics of data outflow from Snort, its frequency was counted, and the characteristics of threaten data were added into the Snort abnormal feature library, and the unknown intrusion interception were realized. The improved system prevents the unknown intrusion events effectively, reduces the loss rate of the data packets and improves the comprehensive detection ability of intrusion detection system.

关 键 词：网络安全 入侵检测系统 SNORT 频率检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]