Snort多媒体分类插件的设计与实现  

Designand Implementation of a Snort Multimedia Traffic Classifier

作　　者：翟继强[1] 郭鹏姣 唐远新[1] 

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《哈尔滨理工大学学报》2016年第3期43-48,共6页Journal of Harbin University of Science and Technology

基　　金：黑龙江省教育厅科学技术研究面上项目(12531121)

摘　　要：针对目前网络流量中飞速增长的多媒体数据,设计和实现了一个多媒体分类器,作为可选的Snort预处理插件,通过解析多媒体文件格式和协议的特定信息,来增强Snort检测引擎针对多媒体类型网络攻击的识别处理能力.通过实验测试了下载流量和流媒体网络数据,实验结果表明,本方法可以有效提高入侵检测系统的性能,同时降低了高速网络中进行详细流量分析的计算成本.Aiming at the increasing multimedia data in the network traffic, a signed and implemented as an optional preprocessor of Snort, which analyzes the multimedia traffic classifier is despecific information of multimedia file formats and protocols, so as to enhance the capabilities of Snort Detection Engine to identify and deal with mul- timedia-specific network attacks. By experimental test and evaluation with downloading traffic and streaming media data, the results show that this approach effectively improves the IDS performance, meanwhile reducing the computational costs of performing exhaustive traffic analysis in high-speed networks.

关 键 词：入侵检测 SNORT 多媒体 流量分类器 流 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]