基于防火墙的网络入侵检测系统

Firewall-Based Intrusion Detection System

提出了一个基于防火墙的网络入侵检测系统模型 ,克服了传统入侵检测系统不能实现主动控制的缺陷 ,并对设计与实现中的关键技术做了详细的描述·该系统在数据链路层截取实时的数据包 ,对其进行基于安全策略的访问控制分析 ;同时利用事件发生器从截获的IP包中提取出概述性事件信息并传送给入侵检测模块进行安全分析·入侵检测模块采用基于统计的入侵检测技术 ,并采用了Naive Bayes算法·基于该模型设计实现的系统在实际测试中表明对于具有统计特性的网络入侵具有较好的检测与控制能力·

A network intrusion detection system (IDS) based on firewall was described. This system may solve the problem of the traditional IDS which is lack of the active access control online. In this model, time varying data packets are captured on data link layer,and then filtered according to the security policy. Meanwhile,the captured IP packets are reduced to summary events by the event engine to represent the important attributes. After that, these events are transferred to the intrusion detection module to make intrusion analysis. Statistics based intrusion detection and Naive Bayes algorithm were used. The prototype system based on the model was implemented and tested in the real network environment. The system is good at detecting and controlling the network intrusions with statistical features in nature.