基于Windows的主机入侵检测系统联动防火墙的设计与实现

DESIGNING AND IMPLEMENTION OF A WINDOWS-BASED HOST INTRUSION DETECTION SYSTEM RELATED WITH FIREWALL

设计与开发了一个运行在windows200下的轻量级入侵检测系统,系统采用VC++6.0作为开发工具,利用WinPcap技术来捕获网络数据包。在数据包处理方面采用了统计与特征相结合的检测方法,从整体结构而言是一个基于主机的入侵检测系统。文章重点介绍系统总体结构和联动防火墙模块的设计和实现,最后以攻击检测实验加以验证。

A host intrusion detection system was designed and developed in windows 2000. The system captured network data packet by using v e ＋ ＋ 6. 0 as development tool and winpeap teehnology. In disposal of data packet, the system adopts the detection method of combining statistics with eharacteristies. The paper put emphasis on the general system structure and the implemention of module related with firewall. At the end, this paper used an attack test to validate the system.