论文部分内容阅读
分析了基于特征的Snort入侵检测系统,并在此基础上实现了Snort向IPv6网络环境的移植。为了提高入侵检测系统中检测引擎的速度和效率,在分析Snort的规则组织结构和规则匹配过程的基础上,提出了一种IPv6动态规则匹配机制。按照特征参数和共同选项来进一步划分规则,为规则选项关联快表项,对规则匹配的顺序进行动态调整,从而提高了规则匹配速度。实验结果表明,该系统可有效地检测IPv6各种攻击,平均规则匹配速度提高了约19.2%。
The feature-based Snort intrusion detection system is analyzed, and on this basis, the porting of Snort to IPv6 network environment is realized. In order to improve the speed and efficiency of the detection engine in intrusion detection system, an IPv6 dynamic rule matching mechanism is proposed on the basis of analyzing the rule organization structure and rule matching process of Snort. According to the characteristic parameters and common options to further divide the rules, association rules for the table option fast, the order of rules to dynamically adjust the rules to improve the speed of rule matching. The experimental results show that this system can effectively detect all kinds of IPv6 attacks and the average rule matching speed increases about 19.2%.