针对分布式拒绝服务入侵检测系统的设计与实现(英文)

Design and i mplementation of an IDS against DDOS

提出了一种抵御分布式拒绝服务(DDOS)的入侵检测系统(IDS)。该IDS由至少两个部件组成,同时在PC级开源软件组件基础上实现了该IDS。系统中的传感器位于企业防火墙与Internet的连接处,分析器位于防火墙内侧。传感器通过运行tcpdump程序提供基本的网络嗅探功能。分析器每隔一小时通过SSH通道从传感器获取tcpdump数据文件,随后对从子目录过滤器中得到的tcpdump过滤器集合进行分析。实验结果表明,该IDS能有效识别DDOS攻击。

We present an IDS against DDOS. The IDS consisted of at least two pieces and based on PC class hardware running freely available software components. Sensors located between an organizatioffs firewall and Internet connection and an analyzer located inside the firewall. The sensor ran tcpdump to provide a basic sniffer capability. The analyzer fetched each hourly tcpdump file from the sensor through SSH channel and then performed analysis using a set of tcpdump filters from the subdirectory filters. Experimental results show that the IDS can identify DDOS attacks effectively.