Research And Implimentation Of Intrusion Detection System

With the rapid development of computer and network,more and more company and user surf Internet, nerwork security become a unavoidable people have to face, firewall is the first line of defense traditionally, now single firewall can't protect network security when the hacker have more and more enriching knowledge and evasion tool become more and more complex.it is necessary to adopt a deep and multiplex method. Under this background,intrusion detection has been a active research field at all time since 1980's.As a important component of detecting illicit activities it aims at computer and network and preventing them from destroying,intrusion detection was born.Firstly, in the paper I introduce network security problem and the method the network security aim at, network threaten, traditional network technology and the network security module.Secondly I discusses the IDS in detail,including the reason ,the function and the standard and so on. IDS can be divided into two different type according to its origin data,one is based on host, the other is based on network.Intrusion detection technology has two ways, one is anomaly detection, the other is misused detection. Thirdly I discuss the position of IDS in network,the shortage of the IDS and the furture way.Next, I design a network-based intrusion detection system, which is composed of seven parts: network packet capture module,network protocol analysis module, intrusion signature database module, intrusion detection module, response module, storage module and user interface management module. I designe and realize these module, the system capture the network packet with the help of Winpcap,then analysis the packet,mainly analysisIP, TCP, UDP, ICMP protocol, and then display the data and store the data, designed a intrusion detectionlanguage, and realize a intrusion detection database, when capture the network packet, match the packet with the intrusion detection database, if match successfully.it is mean there is intrusion, or it is right.In the last, I point out the future way, and wish learn Linux well, and realize a embedded system.