基于网络的入侵检测系统的感应器组件

A Sensor Component for Network-Based Intrusion Detection System

从简化入侵检测系统的构造出发 ,设计和实现了一个基于网络的入侵检测系统的感应器组件 .该组件提供了较为全面的功能 ,包括采集网络数据、IP重组、TCP层重组和基于多种应用层协议的数据还原 .该组件具有灵活的模块化结构 ,提供了很好的复用性和扩展性 ,并实现了自定义加载的功能 .用户可以根据实际需求定制组件的大小 ,或者添加自定义的模块到组件中 .

To simplify the construction of an intrusion detection system, a sensor component for network-based intrusion detection system is designed and implemented. This component can be used to grasp data packet from network, to reconstruct the IP packet, to reestablish the TCP layer data flow and to restore data of application layer. Based on the module designing method, the component is highly reusable and expandable. With the support of 'loading according to configuration' mechanism, users can readily add to or remove a module from this component. This mechanism enables users to customize the component on the demand of specified requirements so as to make the system more efficient.