Research On Intrusion Detection System Based On Snort For IPv6

The global network based on the Internet generated a great influence on people’s life.With the development of the Internet, its openness, sharing and interconnection degreeare expanding constantly, and it’s getting more and more important in the society withdeeper influence. The network security problem is becoming more and more important.Intrusion detection is defined as the inspection and identification of the computer systemand network system, or the information system illegally attacked in a broad sense, or theprocess violating the security strategy events, and it collects data from networkenvironment analyzing it to find suspicious aggression or abnormal events, and adoptscertain response measures to intercept aggression to reduce the possibility of loss. Atpresent, the Intrusion Detection System (IDS) based on IPv4has been a widely applied,yet the IPv6network hasn’t started wide deployments, and the IDS based on IPv6is stillstudied in progress.Based on the depth analysis of the IPv4network IDS, through the research ofnetwork attacks and cyber threats which the IPv6still faces, combined with the IPv6protocol analysis and intrusion detection technology such as the feature matching basedon rule, he overall design scheme of IPv6network IDS was proposed t.The issue focuses on the design and implementation of the terminal level IPv6network IDS of the overall program. The system is based on Snort which analyses theopen source lightweight network IDS, and joins protocol analysis techniques and featurematching technology based on IPv6rules into the Snort system. Then based on the designdiagram of terminal level IDS for IPv6, this thesis detailed research, design andimplement six modules, such as IPv6packet capture module, IPv6protocol analysismodule, IPv6preprocessing module, IPv6rules parsing and IPv6feature detectionmatching module. The research results in this subject may make some contributions forthe IPv6IDS development.