Network intrusion detection system and method based on application protocol detection engine

Abstract

The invention provides a network invasion detecting system based on the application protocol detecting engine and its method. The application protocol detecting engine comprises three detector units as a application protocol analyzer, a abnormal detector and a feature detector while these detectors can all or partly use simply components object models and supply uniform calling interface. The character of said network invasion detecting method is that the invention comprises three steps as protocol analysis, abnormal detecting and feature detecting. The invention can solve the defect of present network invasion detecting system that the inability for detecting new invasion type; and the invention realizes components of the application protocol analyzer, the abnormal detector and the feature detector by the components technique, which allows the detecting component after decoding can connect the detecting system directly without decoding again, so the spreading and the maintenance of network invasion detecting system are improved.

Description

technical field [0001] The invention belongs to the field of network information security, and in particular relates to a network intrusion detection system and method based on an application protocol detection engine. Background technique [0002] The Network Intrusion Detection System (NIDS for short) is an important part of the network security defense system. Its basic principle is to collect and analyze data packets on the network to detect whether there are events that violate security policies or When an attack event occurs, an alert is issued for the detected event, so that system administrators and automatic response mechanisms can take effective measures in a timely manner to prevent or reduce the damage caused by the attack. [0003] Intrusion detection techniques can be divided into two categories: feature detection and anomaly detection. Feature detection is to match the detected data based on the features of existing attacks, and if it matches, it will be rega...

AI Technical Summary

Problems solved by technology

In terms of anomaly detection, only a simple threshold comparison method is used to detect port scanning attacks, and other forms of attacks are not considered.

[0005] Moreover, the existing network intrusion detection system generally adopts a source-code-level modular mechanism when building its detection engine. For example, Snort adopts a source-code-level plug-in mechanism, but the source-code-level modular mechanism leads to support for new feature detection options and The new application protocol requires a lot of code modification, and the system is not easy to expand and maintain. At the same time, the network intrusion detection system constructed from this only supports the upgrade function of the attack signature, but it does not support the analysis of the new application protocol, the new The attack signature option lacks a convenient and quick automatic upgrade method

Images