基于對(duì)等結(jié)構(gòu)的分布式入侵檢測(cè)系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn).pdf

1、中南大學(xué)碩士學(xué)位論文基于對(duì)等結(jié)構(gòu)的分布式入侵檢測(cè)系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)姓名：趙宣申請(qǐng)學(xué)位級(jí)別：碩士專業(yè)：計(jì)算機(jī)軟件與理論指導(dǎo)教師：王偉平20070401ABSTRACTIntrusionDetectionSystcm(IDS)isanimportantcomponentofcomputersecurityarchitecture，whichcanmonitormaliciousbehaviorsinhostsornetworksandgene

2、ratealertsaboutintrusionssoastotakeresponsestothemTheideaofpeertopeerdistributedIDSproposedinrecentyearsoffersasohtiontotheefficiencyandsecurityproblemsintraditionaldistributedDSAnewDistributedIDSbasedonP2Pstructurenamed

3、PⅡ，SisproposedinthepaperwhichfollowstheIDSstandardbyadoptingIDMEFastheuniformformatofalertsWeprogramaclasslibrarynamedJdomIDMEFusingJDOMtechnologyaStheconversionimerfacefromthevariousalenformatstoD腳format。andimplementthe

4、conversionmechanismofalcrtsgeneratedbySnortThecommunicationprotocolbetweenpeersinPIDSisalsodesigned，variouscomnmnicationmessagesaleexpressedintheformofXMLWreimplementthecommunicationprotocolusingJavaNetworkAPI，localandre

5、motepeersCallexchangetheiralerts，andconfigurecorrelationruleswitheachotherPIDScontainsthefunctionofeorrelationanalyzingforalertsfromlocalandremotepeers，whichcombinesthreemethods：clustering、fusionandcausalitycorrelationTe

6、stusingDA嗽datasotindicatesthat。correlationanalyzingcoulddecreasetheredundancyofalertsandrevealthecausalityrelationofintrusionsFinallythepapersummarizeourworkduringthedesignanddevelopment，anddiscusseshowtoimprovethesystem