摘要
传统的入侵防御系统中对于通过tcp流分片而躲避入侵检测的攻击行为,所采用的应对方法是通过流重组,而当前的流重组方案要么有着严重的系统开销,要么当攻击者将数据包分片得过小时,方法失效.本文提出了流式模式匹配的思想,将对流数据的连续性需求转化为对模式匹配连续性的需求,从而设计了一种基于流式模式匹配的分片攻击检测方法,可代替流重组方式进行分片攻击检测.经过实验证明,本方法在实时性、吞吐量和内存占用等方面优于传统的流重组方法.
For behavior to elude intrusion detection by slicing tcp packets, the traditional intrusion prevention system has to reassemble these packets. But this means serious system cost or losing validity when the slice small enough. This paper presents a new method substituted for stream reassembly to de- tect the slicing attacks, and the authors called it stream pattern matching. In this method, the continuity of the data is converted into the continuity of pattern matching, thus avoid reassembling the stream. After experiments proved that the method is better than the traditional stream-reassemble method in real time, throughput, memory used.
出处
《四川大学学报（自然科学版）》
CAS
CSCD
北大核心
2012年第5期1024-1030,共7页
Journal of Sichuan University(Natural Science Edition)
基金
国家自然科学基金(61173159)
教育部创新工程重大项目培育资金(708075)
国家教育部博士点基金(20070610032)
关键词
入侵防御
流模式匹配
流重组
分片攻击
intrusion prevention, stream pattern match, stream resemble, slicing attack
