开发基于Snort的安全网管和实时检测系统

DEVELOPMENT OF A SNORT-BASED SECURITY NETWORK MANAGEMENT AND REAL-TIME INTRUSION DETECTION SYSTEM

本系统基于网络入侵检测系统 (NIDS)模型 ,放置在比较重要的网段内 ,不停地监视网段中的各种数据包 .对可疑的数据包进行特征分析 .如果数据包与系统内置的特定规则吻合 ,入侵检测系统就会发出警报 .此外还提供部分安全网管功能 ,如数据流量统计和当前活动连接查看等 .本系统主要适用的环境是中小型企业网络或校园网 .

This system based on the model of network-based intrusion detection system(NIDS) is posited at the important network parts, in which it constantly monitors various data packets and analyzes suspicious packets. If the characteristics in the packets coincide with the intrusion regulations built in the system, the NIDS will send out a warning. Furthermore, this system provides some functions of security network management, such as the statistics of data stream, the surveillance of present active connections, etc.. It is suitable to use this system at small-to-medium enterprises network or campus network.