The Design Of Campus Network Distributed Intrusion Detection System Based On Snort

With economic development and widespread usage of network technology, Campus network construction is an inexorable trend of Educational Informationization.As an important part of Internet, Campus network is responsible for teaching, researching, management and service.As good as other networks, campus network also faces with kinds of security problems.How to guarantee the normal operation of campus network from unlawful infringement is an inevitable serious problem.Intrusion Detection technology that compensates the defects of traditional defense technology, can provide active security protection.Intrusion Detection System(IDS) are made for detecting malicious attack, temptations and unauthorized actions of internal users, except for the control of inflows and outflows.As a hot spot in the field of Intrusion Detection, Distributed Intrusion Detection System(DIDS) that provides real-time and full-range protection against internal attacks and outer attacks, effectively guarantees the campus network safety and makes interceptions and alarms before being invaded.This dissertation starts with the campus network safety and discusses several unsafe factor in campus network, then elaborates some relative network security technology.Following the research of IDS, that includes the classification, the methods, the model and the distributed applications, An Open Source IDS called Snort has been analysed.This paper makes a synthesis of some campus network enviroment and formulate the system objective.A DIDS with Snort as core role is preferred.The system that uses Snort distributed architecture comprised of 3 layers:sensor layer, server layer, analysis console.Each layer has been explained clearly and given realized method.System design also includes making monitor strategies and contents, writing the pointed rules for Snort in order to supplement original rule sets.Finally, the analysis of effect is given with the deployment of DIDS in the campus network.