基于改进的BM算法在IDS中的实现

包括论文,设计,论文字数:12861,页数:25

摘  要
入侵检测技术是一种主动保护自己免受攻击的网络安全技术，是继防火墙、数据加密等传统安全保护措施后新一代的安全保障技术，作为防火墙的合理补充，入侵检测技术能够帮助系统对付网络攻击，扩展系统管理员的安全管理能力，提高信息安全基础结构的完整性。
本文首先对入侵检测现状、入侵检测系统组成进行了分析和总结，重点研究了网络入侵检测的核心技术——入侵检测算法。模式匹配算法是基于特征匹配的入侵检测系统中的核心算法，是当前入侵检测设备中普遍应用的算法。模式匹配的效率决定了入侵检测系统的性能。通过对开放源代码的snort中模式匹配技术的改进，提出了一种更快的模式匹配算法，该算法可以加快入侵检测系统的检测速度，提高现有入侵检测系统的检测能力。

关键词：BM算法；入侵检测系统；模式匹配；单模式匹配算法

Implementation of Improved BM Algorithm in IDS
Abstract
Intrusion Detection Technology is such a kind of safe technologies that can make one avoid being attacked by network practices voluntarily, a new generation of security technology after the traditional security protective measure, such as fire wall, data encrypted etc. As a rational supplement of fire wall, Intrusion Detection Technique can help the system to deal with attacks from network and expand security managerial ability of system manager, and raise the integrality of the security infrastructure of the information.
First, this dissertation analyses and summarizes the current status of intrusion research, focuses on research and practice on intrusion detection system (IDS) algorithm which is technique difficulties in network intrusion detection. Pattern Matching Algorithm is central algorithm in signature based on IDS. The effect of these IDS is dominated by pattern matching algorithm used. By means of improving the pattern matching technique in open source code-snort, an even faster algorithm of pattern matching is presented so that the detection speed of IDS can be increased and the detective ability of available IDS is proved.

Key words: BM Algorithm; IDS; Pattern-matching; Single Pattern-matching Algorithm
目  录

1  引言 1
1.1 课题背景 1
1.2 本课题研究的意义 2
2  入侵检测系统概述 2
2.1 入侵检测的概念 2
2.2 入侵检测系统的组成及部署 2
2.2.1 入侵检测系统的组成 2
2.2.2 入侵检测系统的部署 3
2.3 网络入侵检测系统Snort 3
2.3.1 Snort系统概述 3
2.3.2 Snort系统简要分析 4
2.3.3 Snort系统部分源码简介 6
3  BM算法 6
3.1 BM算法 6
3.1.1 BM算法具体介绍 6
3.1.2 BM算法预处理 8
3.1.3 BM算法查找 9
3.2 BM算法字符匹配实例 9
4  BM算法的改进和实现 12
4.1 BM算法的改进思想 12
4.2 改进的BM算法 14
4.3 改进的BM算法与BM算法的性能比较 16
4.3.1 性能实例比较 16
4.3.2 性能测试比较 17
4.4改进的BM算法在Snort系统中的实现 18
结    论 19
参考文献 19
致    谢 20
声    明 21