Improved testing system and method for realizing NIDS (Network Intrusion Detection System) and NIPS (Network Intrusion Prevention System) intrusion detection function

Abstract

The invention relates to an improved testing system and method for realizing an NIDS (Network Intrusion Detection System) and NIPS (Network Intrusion Prevention System) intrusion detection function. The system comprises an attack module, a fragmenting module and a testing module which are arranged inside the same host machine, wherein the testing module and the fragmenting module are connected with an external tested system; and the external tested system is used for recombining fragmented attack data messages, and testing whether the external tested system has the intrusion detection functionor not by judging whether a message recombination result of the external tested system corresponds to an attack data message sent by the attack module or not. Through adoption of the improved testingsystem and method for realizing the NIDS and NIPS intrusion detection function, a virtualization technology is used, the working mode of a virtual machine network card is set, and testing for the NIDS and NIPS intrusion detection function can be realized through a single physical PC (Personal Computer), so that the usage quantity of physical PCs required for testing is reduced; the cost is lowered; the testing efficiency is increased; and the problem of difficulty in maintaining and moving the environment is solved.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to the field of testing, in particular to an improved testing system and method for realizing the intrusion detection function of NIDS and NIPS. Background technique [0002] Existing methods for testing the intrusion detection functions of NIDS and NIPS include the test method of using instruments and meters and the method of using multiple physical PCs to respectively install attacking application programs to build an experimental environment. For the first test method that uses instruments and meters, it is first necessary to obtain instruments and meters, and then to test the intrusion detection function of NIDS and NIPS by selecting and configuring the attack type of instruments and meters, but the instruments and meters are expensive and the environment is closed. It is not easy to upgrade the attack type, thus limiting the scope and flexibility of its use. The second ...

AI Technical Summary

Problems solved by technology

However, the current method of building a test environment requires the use of multiple physical PCs for cooperative testing. The test environment is complex and difficult to maintain and move

Images