基于多层检测的网络安全防范系统

提出了一种基于多层的网络安全防范系统,该系统采用多层检测技术：在IP层采用基于聚集的拥塞控制算法（ABCC）,通过限制拥塞信号的宽度,使间接损害达到最小;然后在TCP和UPD层采用基于人体免疫原理的检测技术AIPT,通过建立规则集,将来自网络访问活动与规则集中的规则匹配,以检测出网络入侵行为。仿真实验结果表明,基于本模型的系统不仅能合理地缓解DoS/DDoS攻击,而且能够解决现有的防范系统中高误报率和漏报率以及实时性差、人工干预多的问题。

Multi-layered based network security defense system

A multi-layered based network security defense system(MNSDS) was presented.MNSDS adopts multi-layered detection technology: for the detection of IP layer,aggregate-based congestion control algorithm(ABCC) was adopted,narrowing the congestion signature,and thus minimizing collateral damage;then,it employs the detection technology based on the artificial immune principle in TCP and UDP layers AIPT,and detects intrusion by creating a rule database and matching the appropriate rule.The simulation results indicate that the system not only can provide relief from DoS/DDoS attacks equally,but also resolve problems existing in the current defense systems such as low speed high false positive probability and high false positive probability,poor real-time and more artificial interventions.