The Emulation System Of The Intelligence Invades

Along with calculation with technical development, especially technical development in network, the calculator system have developed from the independent host complicated, with each other the system of the open type that connect, this a the variety cause system invaded of spread.At the same time, computes the operate system to corresponds by letter the technical complexity to increases continuously with the network, not only caused the complicacy increment that invade, but also increased the design with realizes the difficulty that real dependable safety defend of system.Invade to examine the system( IDS) conduct and actions safety defensive finally a defense line, can used for examining the multiform invading the behavior, is an importance of the safety defense system to constitute the part.Technical development in calculator with invade technical development as into the research that lift examined the system to put forward the new request.Break to the technical in safe key in information from the outside the country with limit face our country exit, our country safe research in information start than night, result in the our country current the network safety becomes a bottleneck that making and inviting information industry, electronic commerce,etc.In that case, we have the necessity to value the information the safety more, giving its the position that should have, and step up to research to manufacture the related software tool.Safe and count for much key in information in conduct and actions a wreath, invade the examination, early-warning technique should cause our value.Similar to other system, invade to examine the system oneself to also usually exsits safe loophole.If to invade to examine the system attack successful, then directly cause its report to the police out of order, invader at afterward a behavior for making will can't drive record.This lesson topic is to develops a set of useding for the examination into the intelligence attack software of the examination system.Step aside to send out to come of invade the system that examine the resources depletion have the less, doing not affect to sufferto protect the normal movement between host or network;The misinformation is to the best little with the circumstance that fail to report.Making network invaded to examine system can make all arrangements in different network environment.In a depletion for or a special line ascending making all arrangements network invading examining system, then can using commonly invading examining engine, lowering resources.But in carried higher environment, then use to invade to examine the engine super-speedly, lift the high performance in order to.Support of invade the characteristic number morely;Supporting the fragment of IP reorganizes, this is because of in invade examination, analyze the single an accuracy for of data pack would causing many misinformations with failing to report, chippy reorganization in IP can increasing examination.And, the fragment of IP is an in common use method in inside in attack in network, therefore, the chippy reorganization in IP can also examine the chippy attack in IP in exploitation.The IP fragment reorganization measures the standard has three character can parameter: the cent in biggest IP number that can reorganize; can the number of IP reorganized at the same time; can proceed length that the biggest IP data pack that reorganize.Supporting the TCP flows the reorganization, the TCP flows reorganization is for proceeding the analysis to the complete network dialogue.Such as check mail contents, enclosure, check the data that FTP deliver, prohibition against interview harmful website, judge illegal HTTP claim .