| 基于CIDF的网络入侵检测系统设计与实现 |
| |
| 引用本文： | 常佶,陈志坚. 基于CIDF的网络入侵检测系统设计与实现[J]. 内蒙古工业大学学报, 2006, 25(2): 90-96 |
| |
| 作者姓名： | 常佶 陈志坚 |
| |
| 作者单位： | 内蒙古工业大学信息工程学院 呼和浩特010051 |
| |
| 摘 要： | 文中设计并实现了在L inux平台上基于C IDF框架的网络入侵检测系统,采用了异常和误用相结合的检测技术.实现了基于L ibpcap的网络数据包的捕获,在对入侵行为特征进行分析的基础上定义了入侵规则库,利用规则解析模块实现了入侵规则解析.经过测试,本系统能够准确检测出端口扫描、T rinoo攻击、CG I扫描.
|
| 关 键 词： | 网络入侵检测系统(NIDS) 通用入侵检测框架(CIDS) 端口扫描 |
| 文章编号： | 1001-5167(2006)02-0090-07 |
| 收稿时间： | 2005-10-26 |
| 修稿时间： | 2005-10-26 |
DESIGN AND IMPLEMENTATION OF NIDS BASED ON CIDF |
| |
| CHANG Ji,CHEN Zhi-jian. DESIGN AND IMPLEMENTATION OF NIDS BASED ON CIDF[J]. Journal of Inner Mongolia Polytechnic University(Social Sciences Edition), 2006, 25(2): 90-96 |
| |
| Authors: | CHANG Ji CHEN Zhi-jian |
| |
| Affiliation: | School of Information Engineering, Inner Mongolia University of Technology, Hohhot 010051, China |
| |
| Abstract: | A network intrusion detection system based on CIDF in Redhat Linux has been designed and implemented.This NIDS can be applied to both misuse intrusion detection and abnormal intrusion detection.Packet capture is realized with Lipcap.Intrusion behaviors are analyzed.Based on the analysis,an intrusion signature database is defined.A rule analysis module is used to analyze the rule of intrusion.Through testing,it is proved that,with the help of this NIDS,the port scan,Trinoo attack and CGI scan can all be detected. |
| |
| Keywords: | network intrusion detection system(NIDS) CIDF port scan |
| 本文献已被 CNKI 维普 万方数据 等数据库收录！ |
