基于NDIS中间驱动的入侵检测

为了实现基于NDIS的入侵检测,根据NDIS中间驱动的基本原理,采用微软提供的驱动程序开发包,实现了将数据链路层上的所有原始数据包截获.由于中间驱动深入Windows内核,与硬件关系紧密,具有不可绕开性与协议无关性,所以必须自定义数据包的解析.介绍了实现的关键代码,并根据入侵检测的原理,深入分析各种入侵行为特征和截获的数据包,实现中间驱动和入侵检测相结合,对可能出现攻击和端口秘密扫描进行过滤,来达到入侵检测的目的.

Intrusion detection based on NDIS intermediate drivers

In order to implement intrusion detection based on NDIS,according to NDIS intermediate driver's basic principle,using driver development kit that Microsoft provided,capture all raw data packets at data link layer.Because of NDIS intermediate driver locate inside of Windows kernel,with hardware relation close,can't keep away from and independent of protocol layer,so must self-defining analysis that protocol type.Describing the detailed implement codes,according to detection principle,analyzing in depth various intrusion behaviors and characteristic and raw data packets,combine with NDIS intermediate driverand detection principle,revea-ling attack and port stealth scan might be appear,to achieve the goal of intrusion detection.