分布式入侵监测系统设计与实现摘 要随着黑客入侵事件的日益猖獗，人们发现只从防备的角度构造安全系统是不够的。入侵检测技术是继“防火墙”、“数据加密”等传统安全保护措施后新一代的安全保障技术。他对计算机和网络资源上的恶意使用行为进行识别和响应，它不仅检测来自外部的入侵行为，同时也监督部用户的未授权活动。本文提出一种基于部件的入侵检测系统，具有良好的分布性能和可扩展性。他将基于网络和基于主机的入侵检测系统有机地结合在一起，提供集成化的检测、报告和响应功能。在网络引擎的实现上，使用了协议分析和模式匹配相结合的方法，有效减小目标的匹配围，提高了检测速度。同时改进了匹配算法，使得网络引擎具有更好的实时性能。在主机代理中的网络接口检测功能，有效地解决了未来交换式网络中入侵检测系统无法检测的致命弱点。关键字 入侵检测；模式匹配AbstractWith more and more site intruded by hackers, security expert found than only use crypt technology to build a security system is not enough. The Intrusion Detection is a new security technology, apart from tradition security protect technology, such as firewall and data crypt. IDSs watch the computer and network traffic for intrusive and suspicious activities. they not only detect the intrusion from the Extranet hacker, but also the intranet users.We design a component-based Intrusion Detection System, which has good distribute and scalable ability. It combine the network-based IDS and host-based IDS into a system, and provide detection, report and respone together.In the implement of the network engine, the combination of network protocol analyze and pattern match technology is used, and reduce scope to search. We also improved pattern match algorithm, the network engine can search intrusion signal more quickly. We use network interface detection in host agent, which will enable the IDS work on switch network fine.KeywordIDS; pattern match毕业设计（论文）原创性声明和使用授权说明原创性声明本人...
