Ndis-based Intrusion Detection System Research

With the arrival of information age, Science and technology is developed at full speed. The technology of the computer, especially network technology have already got deeply to each field of the society, influencing politics, economy, cultural, military, and all respects of the society live, etc. various kinds of activity of human society have heavy degree of dependence to computer network, and the network security has already become the focus that countries all over the world have paid close attention to.Intrusion Detection System is a kind of new-type network security , as an important link in the information security, it can solve the problem that access and control ,identity authentication and fireworks can not solve , it got the development at full speed as a initiative mean of defense of network .At first this dissertation introduce the Intrusion Detection System, has discussed the function, principle and classification of the Intrusion Detection System, and has analyzed the limitation of traditional Intrusion Detection System, secondly, have analyzed the principle of common network attacks and provided the general methods of defending.For the characteristic of the environment of the high-speed network, it is analyzed that the limitation of the traditional Intrusion Detection System. There are two main reasons that its performance is low, the first is, catch engine can not catch package high-efficiently and across-the-aboard. The second is, the analysis algorithm adopted by analysis engine is not high in speed, can not meet the environment of the high-speed network. In order to solve the problem, among chapter four a package catch engine based NDIS is designed and implemented, among chapter five, an improved multiple pattern match algorithm is given, so the analysis engine can obtain high efficiency. Through the test, these methods can improve the performance of the Intrusion Detection System.