网站入侵案件中的电子证据研究

为了提高电子证据勘查取证水平,有效打击网站入侵案件,笔者通过模拟网络环境对常见网站入侵方式进行研究,同时也对近两年侦办的网站入侵案件进行了分析.文章阐述了在网站入侵案件中电子证据现场勘查需要重点勘查服务器日志、网站日志、木马文件、特殊目录下的特殊文件等日志和文件,需要提取、固定IP地址、用户名、计算机名称、虚拟身份、入...     

字符串模式匹配算法的改进研究

字符串模式匹配算法是入侵检测系统中的一种重要算法。通过对KMP算法和BM算法以及其他改进算法的分析,提出一种简单实用、易于理解的字符串匹配改进算法。实验表明该算法能减少模式匹配中字符的比较次数和尝试次数,提高模式匹配的效率。     

Protecting Against Address Space Layout Randomisation （ASLR） Compromises and Return-to-Libc Attacks Using Network Intrusion Detection Systems

Writable XOR executable (W⊕X) and address space layout randomisation (ASLR) have elevated the understanding necessary to perpetrate buffer overflow exploits[1]. However, they have not proved to be a panacea[1–3], and so other mechanisms, such as stack guards and prelinking, have been introduced. In this paper, we show that host-based protection still does not offer a complete solution. To demonstrate the protection inadequacies, we perform an over the network brute force return-to-libc attack against a preforking concurrent server to gain remote access to a shell. The attack defeats host protection including W⊕X and ASLR. We then demonstrate that deploying a network intrusion detection systems (NIDS) with appropriate signatures can detect this attack efficiently.     

A parameterized multilevel pattern matching architecture on FPGAs for network intrusion detection and prevention

Pattern matching is one of the most performance-critical components for the content inspection based applications of network security, such as network intrusion detection and prevention. To keep up with the increasing speed network, this component needs to be accelerated by well designed custom coprocessor. This paper presents a parameterized multilevel pattern matching architecture (MPM) which is used on FPGAs. To achieve less chip area, the architecture is designed based on the idea of selected character decoding (SCD) and multilevel method which are analyzed in detail. This paper also proposes an MPM generator that can generate RTL-level codes of MPM by giving a pattern set and predefined parameters. With the generator, the efficient MPM architecture can be generated and embedded to a total hardware solution. The third contribution is a mathematical model and formula to estimate the chip area for each MPM before it is generated, which is useful for choosing the proper type of FPGAs. One example MPM architecture is implemented by giving 1785 patterns of Snort on Xilinx Virtex 2 Pro FPGA. The results show that this MPM can achieve 4.3 Gbps throughput with 5 stages of pipelines and 0.22 slices per character, about one half chip area of the most area-efficient architecture in literature. Other results are given to show that MPM is also efficient for general random pattern sets. The performance of MPM can be scalable near linearly, potential for more than 100 Gbps throughput. Supported by the National Natural Science Foundation of China (Grant No. 60803002), and the Excellent Young Scholars Research Fund of Beijing Institute of Technology     

网络安全量化评估系统的研究与应用

1 引言随着计算机网络技术的不断发展,各种信息系统对计算机网络的依赖越来越强,网络安全的研究日益引起了广泛的重视,特别是在网络安全的量化评估研究领域已经取得了不少的研究成果。目前,国内外的研究者分别从不同的角度对网络安全进行研究,主要研究方向有:①从逆向工程的角度分析目标对象存在的脆弱性;②从程序代码实现的角度出发,对代     

基于入侵检测模型的蠕虫病毒诱捕系统的研究

该文介绍了目前入侵检测系统的研究状况并讨论了网络蠕虫病毒的传播过程,结合网络诱捕系统,对如何诱捕网络蠕虫病毒进行了研究,给出了一个自动诱捕网络蠕虫病毒的模型和实现方法。     

高校办公网入侵检测系统研究

随着计算机和网络技术的发展，网络入侵事件的日益增加，人们发现只从防御的角度构造安全系统是不够的，入侵检测成为继“防火墙”、“数据加密”等传统安全保护措施后新一代的网络安全保障技术。本文首先介绍入侵检测原理和分布式入侵检测方面的相关工作．在分析已有分布式入侵检测系统模型的基础上，提出了一个基于代理的校园网入侵检测系统模型框架。该模型采用分布式的体系结构．由一个代理控制中心和若干代理组成．结合了基于网络和基于主机的入侵检测方法。使用代理技术在分布式环境下对入侵进行检测，可以有效地检测各种入侵．并具有很好的可扩充性。     

异或和取模运算的负载均衡算法

引入信息熵对哈希函数的输入值进行随机度测试,实验证明增加异或字段数并划分字段后进行异或运算能提高运算结果的随机测度值.标识字段有很高的位熵值,函数输入值中加入此值能减少负载迁移次数而运算效率与CRC16接近.采用源IP、目的IP、源端口、目的端口、标识字段作为输入值,并划分为8位的比特串进行异或运算,然后再进行取模运算的双哈希算法运算效率较高而且均衡性好,适合于高速网络环境下的入侵检测.     

基于模拟谐振子的优化K-means聚类算法

针对K-means算法全局搜索能力的不足,提出了基于模拟谐振子的优化K-means聚类算法（SHO-KM）,该算法克服了K-means聚类算法对初始聚类中心选择敏感问题,能够获得全局最优的聚类划分。为了提高聚类划分质量,在聚类过程中采用基于Fisher分值的属性加权的实体之间距离计算方法,使用属性加权距离计算方法进行聚类划分时,无论是球形数据还是椭球形数据都能够获得较好的聚类划分结果。对KDD-99数据集的仿真实验结果表明,该算法在入侵检测中获得了理想的检测率和误报率。     

针对网络入侵检测系统的分析

入侵检测是提高网络安全性的有效手段。本文介绍了入侵检测的原理和方法,并详尽分析了几个实际的网络入侵检测系统,最后简要总结了网络入侵检测系统的发展方向。