一种WEB服务器“受侵检测系统”的设计与实现

Design and Implementation of "Intrusion Detection System" for Web Servers

入侵检测技术是近年来出现的一种新的计算机网络安全技术。由于该技术具有积极、主动的防卫性,使得其实现方法较为复杂,尚属研究阶段;而且成本较高,使得不少中小型WEB服务器用户望而却步。开发一种基于被动防卫的"受侵检测系统",通过对Web资源文件等进行实时监控,同时采用数据包嗅觉技术对IP数据包进行捕获、包解码并提取其中的TCP数据包;然后根据HTTP协议对TCP数据包中的数据项进行分析,从而实现对Web访问者的网络行为进行联动跟踪,实施对Web入侵者的检测;最后给出了Windows下Web服务器的一个可行的设计和实现方案。

Intrusion detection technology is an still inaccessible for many small and medium web emerging network security technology. But it is servers users due to its high costs and complicated implementation. In this paper, an ＂intrusion detection system＂ based on the passive defense was developed to realize linkage tracking of network behaviors of visitors and detecting the web intruders through real-time monitoring of web page resource files＇ changes while using the packet sniffing technique to capture IP packets and extract and decode the TCP packets, and analyzing the data in the TCP packets according to HTTP. A feasible design and implementation for Windows Web server are also presented.