基于NDIS构造Windows下入侵检测系统技术分析

Analysis of Implementing of IDS Based on NDIS in Windows

文中介绍了 Windows 平台下基于 NDIS 中间层技术实现入侵检测的方法。并与一般的使用 WinPcap 技术实现入侵检测系统进行了比较,NDIS 中间层技术在功能和性能方面具有比较突出的优势。我们采用该技术实现了一个模型系统,试验证明它具有较高的性能。

An implementing method of IDS Based on NDIS is stated in this article, and the differences between methods which based on NDIS and that based on WinPcap are discussed. By comparison, the approach based on NDIS is more flexible and has higher performance than WinPcap. We have implemented a model system to prove our opinion.