期刊文献+

基于高速网络环境的Snort主动包过滤预处理器研究 被引量:1

Research on Active Package Filter Preprocessor of Snort Based on High Speed Network
下载PDF
导出
摘要 提出一种Snort主动包过滤预处理插件。在高速网络环境下,通过主动丢弃对检测误报率影响较小的数据包减轻系统负载,避免Snort在超负荷运行情况下的随机丢包现象。由于异常数据包主要来自于每个网络流前面的一定数量的数据包。因此,该预处理器实时地监控Snort的负载变化。当检测引擎负载超过一定阈值时,主动过滤掉网络流后面的正常数据包。实验表明,使用主动包过滤预处理器并采用一定的Snort调整行为,可以在保证较低误报率的前提下,有效降低Snort的漏报率,提高系统的检测效率。 An active package filter preprocessor is designed and implemented for an open source network intrusion detection system Snort.In high speed network environment,the preprocessor can actively discard the packages which have subtle impact on false positive alarm rate and avoid randomly discard packages by snort itself.Because of the fact that abnormal packages locate at the front of network flow,the preprocessor monitor the load changing of snort in real-time manner and active filter the packages locate at the tail of a network flow when the threshold of detection engine load is surpassed.Through experiments,using the active package filter preprocessor and adopting some behaviour to adjust snort,the snort can effectively decrease the false negative alarm rate while keeping relative low false positive alarm rate,and the detection efficient of snort can be greatly improved.
作者 张雪松
出处 《科学技术与工程》 北大核心 2012年第27期7104-7108,共5页 Science Technology and Engineering
关键词 网络入侵检测系统 包过滤 预处理器 network intrusion detection system package filter preprocessor
  • 相关文献

参考文献5

  • 1Caswell B,Beale J,Foster J C,等著.宋劲松,等译.Snort2.0入侵检测.北京:国防工业出版社:2004.
  • 2张雪松.基于级联AdaBoost的Snort异常检测预处理插件研究[J].科学技术与工程,2011,11(17):3997-4001. 被引量:1
  • 3(美)Jack Kozi01.snort入侵检测实用解决方案.吴浦峰,孙默,许诚,等译.北京:机械工业出版社,2005.
  • 4武旭东.snon入侵检测系统研究与应用.长春:吉林大学,2011.
  • 5Haines J A, Rossey L M, Lippmann R P, et al. Extending the DAR- PA offLine intrusion detection evaluations. In:Darpa Information Survivability Conferenceand Exposition (DISCEX) II. U. S. A ,2001, 77-88.

二级参考文献5

  • 1(美)J Koziol J著,吴浦峰,孙默,许诚,等译.Snort入侵检测实用解决方案.北京:机械工业出版社,2005.
  • 2Caswell B,Beale J,Foster J C,等著.宋劲松,等译.Snort2.0入侵检测.北京:国防工业出版社:2004.
  • 3Freund Y, Schapire R E. A decision-theoretic generation of online learning and an application to boosting. Journal of Computer and System Science, 1997 ;55 ( 1 ) : 119-139.
  • 4Viola P, Jone M J. Robust real-time face detection. International Journal of computer vision,2004 ;57 (2) : 137-154.
  • 5Friedman J, Hastie T, Tibshirani R. Additive logistic regression: A statistical view of boosting. Ann Statist , 2000, 28 (2) : 337-407.

共引文献1

同被引文献59

引证文献1

二级引证文献3

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部