Intrusion Detection System Based On Tcp / Ip Protocol Analysis And Realization

With the rapid development of computer and communication technology, computer system has been developed from independent host to complex and interconnects networks. It brings great convenience to people for sharing of information. But along with the great benefit of internet, it also brings new threats. Problems on security of internet are becoming very serious. Thus the research of computer network security is also becoming very important.Firstly, the thesis analyzes the goal of computer network security and the security threat of network faced, and then introduces several traditional security techniques such as data encryption techniques and firework techniques. It analyzes the problems of these traditional security techniques and brings forward combine intrusion detection system (IDS) and the traditional network security techniques to create multi-layers recovery system. It indicates the status in security domain and its significance of IDS. Secondly, the thesis goes deep into particulars IDS in details, from basic concept, model and theory. Thirdly, the thesis analyzes the frangibility of the TCP/IP protocol and the non-security of Internet behind it. Afterward, the thesis expatiates on the design thought and implementation method of distributed IDS with CIDF framework based on protocol analysis. The system has been applied to LAN of Chengdu Sunrise Information Technology CO.,LTD.The cores of the IDS are real-time and veracity. With the development of high speed network, the throughout of network becomes great. It is the present focus how to detect the packet of data in network in real time and veracity (false positives and false negative). The IDS design of this thesis is based on the above points. It aimed at improving its detecting speed and exactness.In the end, the thesis discusses the research status and future development of IDS.