Similar documents

2



2



-2-





Supply Chain SCM IBM DRP



50 2

XML SOAP DOM B2B B/S B2B B2B XML SOAP


() MONORCHIIDAE SP

X UDC A Post-Evaluation Research on SINOPEC Refinery Reconstruction and Expanding Project MBA 厦门大学博硕士论文摘要库


2

1


WTO

1

厦 门 大 学 学 位 论 文 原 创 性 声 明 本 人 呈 交 的 学 位 论 文 是 本 人 在 导 师 指 导 下, 独 立 完 成 的 研 究 成 果 本 人 在 论 文 写 作 中 参 考 其 他 个 人 或 集 体 已 经 发 表 的 研 究 成 果, 均 在 文 中 以 适 当 方



% 6.7% % % / 1


UDC The Policy Risk and Prevention in Chinese Securities Market

Abstract Since 1980 s, the Coca-Cola came into China and developed rapidly. From 1985 to now, the numbers of bottlers has increased from 3 to 23, and




:

1998 5


Abstract After over ten years development, Chinese securities market has experienced from nothing to something, from small to large and the course of

WTO

Abstract Today, the structures of domestic bus industry have been changed greatly. Many manufacturers enter into the field because of its lower thresh

Abstract There arouses a fever pursuing the position of being a civil servant in China recently and the phenomenon of thousands of people running to a




WTO OEM


THE APPLICATION OF ISOTOPE RATIO ANALYSIS BY INDUCTIVELY COUPLED PLASMA MASS SPECTROMETER A Dissertation Presented By Chaoyong YANG Supervisor: Prof.D

:




厦 门 大 学 学 位 论 文 原 创 性 声 明 本 人 呈 交 的 学 位 论 文 是 本 人 在 导 师 指 导 下, 独 立 完 成 的 研 究 成 果 本 人 在 论 文 写 作 中 参 考 其 他 个 人 或 集 体 已 经 发 表 的 研 究 成 果, 均 在 文 中 以 适 当 方

I

UDC 厦门大学博硕士论文摘要库

100Mbps 100Mbps 1000Mbps 100Mbps 1000Mbps 100Mbps 100Mbps PD LXT Mbps 100Mbps 100Mbps 1



F4

- 2 -


WTO WTO ATM POS 4 CRM 2

- 2 - Russell Thaler unexpected dramatic P t =P t-1 + P t t P t-1 t-1 2 T.Russell and R.Thaler, The Relevance of Quasi-Rationality in Competitiv



Abstract / / B-ISDN ATM Crossbar Batcher banyan N DPA Modelsim Verilog Synopsys Design Analyzer Modelsim FPGA ISE FPGA ATM ii

IP TCP/IP PC OS µclinux MPEG4 Blackfin DSP MPEG4 IP UDP Winsock I/O DirectShow Filter DirectShow MPEG4 µclinux TCP/IP IP COM, DirectShow I


Research for RS encoding and decoding technology in the Digital Television Terrestrial Broadcasting System 2006 厦门大学博硕士论文摘要库

untitled

J. D. 17 Daniel J. Elazar, American Federalism: A View From the States (New York: Happer & Row, Publishers, 1984), p

1

豐佳燕.PDF

<4D F736F F F696E74202D FC2B2B3F85FA44AAB49B0BBB4FABB50B977A8BEA874B2CEC2B2A4B6BB50C0B3A5CE2E707074>

声 明 本 人 郑 重 声 明 : 此 处 所 提 交 的 硕 士 学 位 论 文 基 于 等 级 工 鉴 定 的 远 程 考 试 系 统 客 户 端 开 发 与 实 现, 是 本 人 在 中 国 科 学 技 术 大 学 攻 读 硕 士 学 位 期 间, 在 导 师 指 导 下 进 行 的 研 究

Mechanical Science and Technology for Aerospace Engineering October Vol No. 10 Web SaaS B /S Web2. 0 Web2. 0 TP315 A

1

Kluyveromyces sp. Y-85 Saccharomyces cerevisiae E-15, E g/100ml Y-85 E-15 DNA Y YEPD MM E E-15 Y-85 Y-85 12h E h 0.1%ED

2002 II

Symantec™ Sygate Enterprise Protection 防护代理安装使用指南

X MGC X 22 X 23 X MGC X BALB/c 26 X MGC X MGC X MGC X..

Shanghai International Studies University THE STUDY AND PRACTICE OF SITUATIONAL LANGUAGE TEACHING OF ADVERB AT BEGINNING AND INTERMEDIATE LEVEL A Thes


國家圖書館典藏電子全文

University of Science and Technology of China A dissertation for master s degree Research of e-learning style for public servants under the context of

epub 61-2

软 件 工 程 专 业 习 指 南 目 录 一 软 件 工 程 专 业 设 置 背 景 与 发 展 前 景... 3 二 软 件 工 程 专 业 实 践 教 条 件... 4 三 软 件 工 程 专 业 课 程 类 型 及 核 方 式 软 件 工 程 专 业 课 程 类 型...7


厦门大学博硕士论文摘要库

<4D F736F F D20312D3120B9ABBFAAD7AAC8C3CBB5C3F7CAE9A3A8C9EAB1A8B8E5A3A92E646F63>

.1 Abstract LD MAX PCB MC P

...1 Abstract

Microsoft Word - A _ doc


2.

Research on the Mycorrhizal Community of Pinus Massoniana Lamb in Wuyishan Nature Reserve Abstract Mycorrhizae is the symbiosisal body of fugus and bo

Microsoft Word - 专论综述1.doc

indd


Transcription:

UDC Design and Application of Intrusion Detection System Based on Snort 2009 12

Snort Snort Apriori Snort Apriori Microsoft Visual Studio 2008 C# Snort Snort Snort Snort Snort Apriori Snort Snort Apriori

Abstract Abstract Intrusion detection is one of the main research directions in network security. However, most of the practical intrusion detection systems usually identify attacks by matching known attacks database with collected network data. These pattern match-based methods are highly effective in detecting known attacks, but they don't work well in detecting unknown attacks or the variations of some known attacks. This dissertation describes the intrusion detection and data mining related technologies and focuses on analyzing the Snort module structure and work processes, which provides a theoretical foundation for a new Snort NIDS; Secondly, it analyzes Apriori algorithm and proposes its improvements in terms of the algorithm defects and the data-mining-based requirements for Snort intrusion detecting system. Finally a Snort-based log analysis console is independently designed and developed with Microsoft Visual Studio 2008 and C# language, which consists of three functions: rule configuration module, data analysis module, and report module. Among them, rule configuration module is mainly to facilitate the Snort rule set and modify; data analysis module is to pre-process collected network data packets and to add an Apriori-based algorithm anomaly detection module to its own testing modules, thus generating a new set of rules anomaly detection to enhance detection efficiency for the detection of unknown network intrusion; report module is mainly to organize and put out the invasion information and facilitate the its browse and summary view. The platform is also under an experimental environment simulation testing, the final results show that the system has improved the original Snort detection efficiency. The system is now being applied to ChengYi college of Jimei University with visible outcome. It has effectively prevented network security accidents with its capacity to detect attacks in a timely manner. Key words: Snort; Apriori; rules detection

... - 1 - - 3 -... - 5 - - 5 - - 6-2.2.1...- 6-2.2.2...- 7-2.2.3...- 8 -... - 8-2.3.1...- 8-2.3.2...- 9 -... - 10-2.4.1 HIDS...- 10-2.4.2 NIDS...- 10-2.4.3...- 11 -... - 12 -... - 13-2.6.1 Snort...- 14-2.6.2 Snort...- 17-2.6.3 Snort...- 24 -... - 26 -... - 26 -... - 27-3.2.1...- 29-3.2.2 Apriori...- 32 -

3.2.3...- 38 -... - 39 -... - 39 -... - 40-4.2.1winpcap...- 40-4.2.2 winpcap...- 41-4.2.3 Snort...- 42 -... - 43-4.3.1 MySQL...- 43-4.3.2 MySQL...- 44-4.3.3 MySQL...- 44 -... - 45-4.4.1...- 47-4.4.2...- 48-4.4.3...- 50 -... - 51-4.5.1...- 51-4.5.2...- 51-4.5.3...- 52 -... - 56 -... - 57 -... - 57 -... - 57 -... - 62 -

Contents Chapter I Introduction... - 1-1.1 The Background, Purpose and Meaning of Reseach... - 1-1.2 The Level of Development and the Status at Home and Abroad... - 2-1.3 The Main Structure of This Article... - 3 - Chapter II Introduction to Intrusion Detection Systems, Technical Analysis and Snort... - 5-2.1 The Concepts of Intrusion Detection... - 5-2.2 The Classification of the Intrusion Detection Technology... - 6-2.2.1 Misuse Intrusion Detection Technology...- 6-2.2.2 Anomaly Intrusion Detection Technology...- 7-2.2.3 Compare the Misuse Detection andanomaly Detection Technology...- 8-2.3 Structure and Function of the Intrusion Detection System... - 8-2.3.1 Structure of the Intrusion Detection System...- 8-2.3.2 The Functions of the Intrusion Detection Systems...- 9-2.4 Classification of the Intrusion Detection System... - 10-2.4.1 Host-based Intrusion Detection System HIDS...- 10-2.4.2 Network-based Intrusion Detection System NIDS...- 10-2.4.3 Hybrid of the Intrusion Detection System...- 11-2.5 Challenges and Facing the Problems of the Intrusion Detection Systems...- 12-2.6 Introduction of the Snort System... - 13-2.6.1 Structure and Function of the Snort Module...- 14-2.6.2 Snort Workflow...- 17-2.6.3 Performance of Snort...- 24 - Chapter III Snort Based on Data Mining Algorithm for Performance Improvement... - 26-3.1 Basic Knowledge of Association Rules... - 26-3.2 Anomaly Detection Module Based on Apriori Algorithm... - 27-3.2.1 Data Pre-processing Module...- 29-3.2.2 Mining Association Rules Based on Apriori Algorithm...- 32 -

Contents 3.2.3 Filtering of Association Rules...- 38 - Chapter IV Improved Snort System in Cheng Yi Institute... - 39-4.1 System Architecture... - 39-4.2 Network Intrusion Detection Layer... - 40-4.2.1 Introduction to the Winpcap...- 40-4.2.2 Analysis of Winpcap Packet Capture Process...- 41-4.2.3 Installation and Configuration of the Snort...- 42-4.3 Database Server Module... - 43-4.3.1 Features of MySQL Database...- 43-4.3.2 Installation and Configuration of the MySQL Database...- 44-4.3.3 MySQL Database Management Program...- 44-4.4 Log Analysis Console... - 45-4.4.1 Rule Configuration Module...- 47-4.4.2 Data Analysis Module...- 48-4.4.3 Report Module...- 50-4.5 The Tested Log Analysis Console... - 51-4.5.1 Test Hardware Environment...- 51-4.5.2 Test Software Environment...- 51-4.5.3 Test Experimental Data...- 52-4.6 System Effectiveness... - 56 - Chapter V Summary and Expectation... - 57-5.1 Summarizes... - 57-5.2 Expectation... - 57 - Acknowledgements... - 62 -

1.1 FINGER FTP File Transportation Protocol TELNET telecommunication net work protocol RPC Remote Procedure Calls DNS Domain Name System ICMP Internet Control Messages Protocol WEB Syn-Flood UDP-Flood Ping-Flood Land-based-Attack, Smurf Attack, Ping Of Death Internet [1] VPN - 1 -

1.2 20 1980 James P. Anderson [2] Computer Security Threat Monitoring and Surveillance 1987 Dorothy Denning [3] An Intrusion Detection Model Dorothy Denning IDES IDES 1990 Heberlein NSM(Network Security Monitor) : 1991 NADIR(Network Anomaly Detection and Intrusion Report) - 2 -

DIDS(Distributed Intrusion Detection System) 1994 Mark Crosbie Gene Spafford IDS (Autonomous Agents) IDS 1995 IDES NIDES (Next -Generation Intrusion Detection System) 1996 GRIDS (Graph-based Intrusion Detection System) 1998 Ross Anderson Abida Khattak Internet 2003 [4] Windows PC [5] 2003 150 87 1.3 Snort Snort, Snort Snort - 3 -

Snort IDS Apriori, Snort Snort - 4 -

Snort 2.1 (Intrusion Detection System IDS) (Intrusion) (Denial of Service) (Intrusion Detection) 1 2-5 -

2.2 2.2.1 2.1 Snort [6] - 6 -

2.2.2 [7] 2.2-7 -

Degree papers are in the Xiamen University Electronic Theses and Dissertations Database. Full texts are available in the following ways: 1. If your library is a CALIS member libraries, please log on http://etd.calis.edu.cn/ and submit requests online, or consult the interlibrary loan department in your library. 2. For users of non-calis member libraries, please mail to etd@xmu.edu.cn for delivery details.

2024 © docsplayer.com 隐私 | 条款 | 反馈