基于Bro的网络入侵检测系统设计及实现策略分析

Design and implementation policy study of network intrusion detection system based on Bro

随着网络技术的迅猛发展,网络应用迅速普及开来,网络安全问题也日益突出。为了应对日趋严峻的网络安全现状,在遵循公共入侵检测框架和入侵检测消息交换格式标准的基础上,通过对比不同的网络入侵检测系统基础架构的性能和复杂度,设计了一个基于一种新一代网络入侵检测系统基础架构——Bro的实时高速网络入侵检测系统,详细阐述了系统的设计方案,深入分析了系统各组件的功能,并对具体的实现策略进行了细致的剖析。

As network technology develops quickly, network applications become more and more popular and network security becomes more and more important. To cope with more severe situations of network security, conforming to CIDF and IDMEF, a NIDS is designed based on a new kind of network intrusion detection system base architecture--Bro and describes each functional component and implementation policy of it.