多网络环境下的差异化入侵特征检测平台的设计与实现  

Design and implementation of differentiated intrusion feature detection platform in multi-network environment

作　　者：周小松[1] 刘帅[2] ZHOU Xiaosong;LIU Shuai(College of Computer Technology & Software Engineering,Wuhan Polytechnic,Wuhan 430074,China;College of Computer Science,Inner Mongolia University,Hohhot 010010,China)

机构地区：[1]武汉职业技术学院计算机技术与软件工程学院,湖北武汉430074 [2]内蒙古大学计算机学院,内蒙古呼和浩特010010

出　　处：《现代电子技术》2017年第10期149-152,共4页Modern Electronics Technique

基　　金：国家自然科学基金青年基金(61502254)

摘　　要：传统的网络入侵特征检测方法,检测准确性低。因此,设计并实现基于Libnids分布式入侵检测系统,该系统将多网络环境分割为不同逻辑区域,各逻辑区域包含不同的分析节点,各分析节点由数据探测部件、分析检测部件和管理控制部件组成。在系统实现方面,利用WinPcap函数库完成数据包的采集,依据采集的数据包,通过WM模式匹配算法和协议分析匹配检测模型,进行差异化入侵特征的检测。实验结果表明,该系统具有较高的检测率、较低的虚警率和漏报率。Since the traditional network intrusion feature detection method has low detection accuracy,a distributed intru-sion detection system based on Libnids was designed and implemented.The system segments the multi-network environment intodifferent logical areas.Each logical area contains different analysis nodes,and each node is composed of the data detectionunit,analysis and detection unit,and management control unit.The WinPcap function library is used to acquire the data pack-age,according to which,the WM pattern matching algorithm and protocol analysis matching detection model are used to detectthe differentiated intrusion feature.The experimental results show that the system has high detection rate,low false alarm rateand low missing report rate.

关 键 词：多网络 差异化入侵特征 WinPcap函数库 检测平台 

分 类 号：TN711-34[电子电信—电路与系统] TP393[自动化与计算机技术—计算机应用技术]