Intrusion Detection System Based On TCP/IP Protocol Analysis

In the paper, an intrusion detection model based on protocol analyzing is proposed. It will improve performance of intrusion detection system, through improving system's framework, detection methods and patern matching arithmetic.First, an improved intrusion detection model based on protocol analyzing is proposed, after researched current advanced theories, techniques and methods, and summarized present intrusion detection models. In the model, protocol verification theory is introduced into the system to make up shotcomings of protocol analyzing method. It can filtrate data before patern matching, which has a great deal of calculations. In the- part of protocol verification, data filtration and state analyzing methods is applied to cut redundancy, it can also shield the intrusion detection system itself from attack,so that the system will be more secure itself. Second, the analyzing and detection part is integrated into a sub-module as a node of protocol tree, Then, the amount of comparation can be cut down, and the performanceof intrusion detection system can be improved.