多网络环境下的差异化入侵特征检测平台的设计与实现

Design and implementation of differentiated intrusion feature detection platform in multi-network environment

传统的网络入侵特征检测方法,检测准确性低。因此,设计并实现基于Libnids分布式入侵检测系统,该系统将多网络环境分割为不同逻辑区域,各逻辑区域包含不同的分析节点,各分析节点由数据探测部件、分析检测部件和管理控制部件组成。在系统实现方面,利用WinPcap函数库完成数据包的采集,依据采集的数据包,通过WM模式匹配算法和协议分析匹配检测模型,进行差异化入侵特征的检测。实验结果表明,该系统具有较高的检测率、较低的虚警率和漏报率。

Since the traditional network intrusion feature detection method has low detection accuracy,a distributed intru-sion detection system based on Libnids was designed and implemented.The system segments the multi-network environment intodifferent logical areas.Each logical area contains different analysis nodes,and each node is composed of the data detectionunit,analysis and detection unit,and management control unit.The WinPcap function library is used to acquire the data pack-age,according to which,the WM pattern matching algorithm and protocol analysis matching detection model are used to detectthe differentiated intrusion feature.The experimental results show that the system has high detection rate,low false alarm rateand low missing report rate.