网络入侵中未知协议识别单元的设计与测试

摘要

为了提高复杂环境下的网络安全性,设计并实现了一种网络入侵中未知协议识别单元.系统通过网络入侵检测模块对网络入侵进行检测并过滤,使得未知协议识别单元的设计不受网络入侵的干扰.利用流量采集模块对网络节点的网络流量进行采集,为后续阶段提供完整的网络数据包以及充分的数据分析样本,将采集的网络数据包以指针的形式返回,发送至流量调度模块.通过流量调度模块将网络数据包的源IP地址作为调度参数,依据用户自定义调度算法将网络数据包传输至指定识别模块,实现整个网络入侵中未知协议识别单元的负载均衡.利用规则匹配模块将从流量调度模块接收到的信息和协议特征库进行匹配,从而实现未知协议的识别.软件设计过程中,对网络入侵中未知协议识别单元进行了详细分析,并给出了网络入侵中未知协议识别的程序代码.仿真实验结果验证了该系统的可行性和实用性.%In order to improve the network security in a complicated environment,an identification unit for unknown proto-cols in network intrusion was designed and realized. System detects and filters network intrusion through the network intrusion detection module to make the unknown protocol identification unit unaffected by the interference of network intrusion. The net-work traffic of the network nodes is collected by traffic acquisition module,which provides complete network data packets and sufficient data analysis samples for later stages,and returns the collected network data packets in the pointer form and sends to the traffic scheduling module. The source IP address of the network data packets is taken as scheduling parameters through traf-fic scheduling module. The network data packets are transmitted to the assigned identification module according to the user-de-fined scheduling algorithm to realize the load balancing of unknown protocol identification unit in the whole network intrusion. the information received by traffic scheduling module is matched with the protocol characteristic library by means of the rule matching module,so as to realize the identification of unknown protocol. In the process of software design,the recognition unit of unknown protocol in network intrusion are analyzed in detail. The program code for unknown protocol recognition in network intrusion is offered. The feasibility and practicability of the system were verified by simulation experiment.