模式匹配与校验和相结合的IP协议识别方法

doi:10.3969/j.issn.1001-2400.2012.03.024

Abstract

Abstract:

In order to reduce the probability of report mistakes and pretermission which is likely to happen, and to improve the nicety of explicating application-level protocols in an intrusion detection system, a method is proposed to identify the IP protocol using the pattern match algorithm and IP header check sum calculation for Ethernet data packs. Firstly, Ethernet data packs are matched with some static characters of the IP header in the proposed method, and then IP protocol check sum calculation is done. As a result, whether the type that the data packs belong to is IP protocol or not can be identified finally. Under the Visual C++software condition, simulations prove the validity and reliability of the proposed method by running the simulated programme based on the data swatch which has been listed. And so the correctness of identifying upper protocols in the future is able to be ensured.

Key words: intrusion detection, IP protocol identification, pattern match, check sum

YANG Jie;LIU Congfeng. IP protocol identification method using the pattern match and check sum[J].J4, 2012, 39(3): 149-153+165.

[1]	CHAI Yanna,LI Kunlun,SONG Huansheng. On the security of the intrusion detection system in smart vehicles [J]. Journal of Xidian University, 2021, 48(3): 31-39.
[2]	LIU Jingmei,GAO Yuanbo. Fast network intrusion detection system using adaptive binning feature selection [J]. Journal of Xidian University, 2021, 48(1): 176-182.
[3]	WEI Mingjun;WANG Yueyue;JIN Jianguo. Intrusion detection design of the impoved immune algorithm [J]. Journal of Xidian University, 2016, 43(2): 126-131.
[4]	CHU Yanjie;LI Yunzhao;WEI Qiang. Improved multi-pattern matching algorithm [J]. J4, 2014, 41(6): 174-180.
[5]	LI Longying;LI Jinku;MA Jianfeng;JIANG Qi. Comprehensive analysis of real-time alerts with attack strategy graphs [J]. J4, 2014, 41(5): 84-90.
[6]	HU Liang-bing;LIU Hong-wei;LIU Bao-chang;WU Shun-jun. Transmit beampattern matching design and waveform optimization for MIMO radar [J]. J4, 2009, 36(6): 1021-1026+1033.
[7]	WANG Yong1;2;TAO Xiao-ling1. Study of the intrusion detection method based on AdaBoost with a hierarchical structure [J]. J4, 2008, 35(2): 345-350.
[8]	LIN Guo-qing;WANG Xin-mei. Reform of the Snort system by the multithreading technique [J]. J4, 2007, 34(6): 887-894.
[9]	LI Sheng-guang1;2;LIU Jian-wei1;2;LI Hui2;ZHANG Qi-shan1. A hierarchical IDS model for MANET based on weighted clustering with self-recommendation [J]. J4, 2007, 34(2): 279-284.
[10]	YAO Lan;WANG Xin-mei. Design and realization of an NIDS benchmark test system [J]. J4, 2005, 32(2): 284-289.
[11]	Lü Xi-xiang;YANG Bo;PEI Chang-xin;SU Xiao-long. A data mining based design for the detection engine of the intrusion detection system [J]. J4, 2004, 31(4): 574-580.

IP protocol identification method using the pattern match and check sum

PDF (PC)

Like

Knowledge

Cited

Abstract

Cite this article

share this article

References

Related Articles 11

Metrics

Comments

Recommended 10