網(wǎng)絡(luò)入侵檢測系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)

第1章  概述                  
 1.1  入侵檢測系統(tǒng)的組成部分                  
 1.2  濫用入侵檢測系統(tǒng)                  
 1.3  非規(guī)則入侵檢測系統(tǒng)                  
 1.4  兩種分析技術(shù)的比較                  
 1.5  入侵檢測系統(tǒng)的層次體系                  
 1.6  進(jìn)一步發(fā)展的若干方向                  
     1.6.1  寬帶高速網(wǎng)絡(luò)的實(shí)時入侵檢測技術(shù)                  
     1.6.2  大規(guī)模分布式入侵檢測技術(shù)                  
     1.6.3  入侵檢測的數(shù)據(jù)融合技術(shù)                  
     1.6.4  先進(jìn)檢測算法的應(yīng)用                  
 1.7  面臨的挑戰(zhàn)                  
     第2章  網(wǎng)絡(luò)編程基礎(chǔ)知識                  
         2.1  分層協(xié)議模型                  
         2.2  開放系統(tǒng)互聯(lián)參考模型OSI/ISO                  
         2.3  TCP/IP參考模型                  
         2.4  UNIX網(wǎng)絡(luò)編程技術(shù)概述                  
         2.5  TCP/IP協(xié)議                  
             2.5.1  網(wǎng)絡(luò)接口層協(xié)議                  
             2.5.2  ARP協(xié)議和RARP協(xié)議                  
             2.5.3  IP協(xié)議                  
             2.5.4  ICMP協(xié)議                  
             2.5.5  TCP協(xié)議                  
             2.5.6  UDP協(xié)議                  
     第3章  網(wǎng)絡(luò)數(shù)據(jù)包截獲機(jī)制分析                  
         3.1  基本的網(wǎng)絡(luò)數(shù)據(jù)包截獲機(jī)制                  
         3.2  高效的數(shù)據(jù)包截獲/過濾機(jī)制                  
             3.2.1  概述                  
             3.2.2  BPF的工作原理                  
             3.2.3  BPF虛擬機(jī)的實(shí)現(xiàn)                  
             3.2.4  BPF程序源代碼                  
         3.3  數(shù)據(jù)包截獲的Libpcap庫函數(shù)接口                  
             3.3.1  概述                  
             3.3.2  Libpcap庫函數(shù)接口                  
             3.3.3  采用Libpcap庫的數(shù)據(jù)包截獲實(shí)例                  
     第4章  入侵檢測引擎的設(shè)計(jì)                  
         4.1  IDES系統(tǒng)概述                  
             4.1.1  什么是IDES系統(tǒng)                  
             4.1.2  IDES的系統(tǒng)設(shè)計(jì)                  
             4.1.3  IDES的審計(jì)記錄格式                  
         4.2  用于入侵檢測的統(tǒng)計(jì)分析測量值                  
             4.2.1  用戶測量值                  
             4.2.2  目標(biāo)系統(tǒng)                  
             4.2.3  遠(yuǎn)程主機(jī)                  
         4.3  基于統(tǒng)計(jì)分析的分析算法                  
             4.3.1  IDES分?jǐn)?shù)值（score）                  
             4.3.2  分?jǐn)?shù)值T2如何從單個測量值獲得                  
             4.3.3  單個測量值類型                  
             4.3.4  S與Q聯(lián)系的啟發(fā)式描述                  
             4.3.5  從Q計(jì)算S的算法                  
             4.3.6  計(jì)算Q的頻率分布                  
             4.3.7  計(jì)算活動強(qiáng)度測量值的Q值                  
             4.3.8  計(jì)算審計(jì)記錄分布測量值的Q值                  
             4.3.9  計(jì)算類別測量值的統(tǒng)計(jì)值Q                  
             4.3.10  計(jì)算序數(shù)測量值的Q值                  
         4.4  相關(guān)的數(shù)據(jù)結(jié)構(gòu)及函數(shù)接口                  
             4.4.1  數(shù)據(jù)結(jié)構(gòu)                  
             4.4.2  函數(shù)接口                  
     第5章  專家系統(tǒng)的應(yīng)用                  
         5.1  概述                  
         5.2  由一個簡單實(shí)例開始                  
         5.3  PBEST的基本語法                  
         5.4  更詳細(xì)的語法介紹                  
         5.5  專家系統(tǒng)的外部接口                  
         5.6  一個示例Makefile                  
         5.7  PBEST語法圖表                  
         5.8  帶參數(shù)的pbcc調(diào)用                  
     第6章  入侵檢測規(guī)則語言的設(shè)計(jì)                  
         6.1  概述                  
         6.2  N-Code語言的詞法元素                  
             6.2.1  字符集                  
             6.2.2  注釋                  
             6.2.3  運(yùn)算符                  
             6.2.4  變量                  
             6.2.5  保留字                  
             6.2.6  常量                  
         6.3  N-Code語言的數(shù)據(jù)類型                  
             6.3.1  概述                  
             6.3.2  array                  
             6.3.3  ethmac                  
             6.3.4  error                  
             6.3.5  int                  
             6.3.6  ipv4host                  
             6.3.7  ipv4net                  
             6.3.8  list                  
             6.3.9  recorder                  
             6.3.10  str                  
             6.3.11  pattern                  
         6.4  N-Code的表達(dá)式                  
             6.4.1  概述                  
             6.4.2  算術(shù)運(yùn)算符                  
             6.4.3  賦值運(yùn)算符                  
             6.4.4  位運(yùn)算符                  
             6.4.5  邏輯運(yùn)算符                  
             6.4.6  關(guān)系運(yùn)算符                  
             6.4.7  其他運(yùn)算符                  
         6.5  N-Code語句                  
             6.5.1  概述                  
             6.5.2  assignment                  
             6.5.3  block                  
             6.5.4  break                  
             6.5.5  declare                  
             6.5.6  expression                  
             6.5.7  foreach                  
             6.5.8  If                  
             6.5.9  off                  
             6.5.10  on                  
             6.5.11  record                  
             6.5.12  requires                  
             6.5.13  return                  
             6.5.14  while                  
         6.6  N-Code中的函數(shù)                  
         6.7  N-Code中的函數(shù)聲明                  
             6.7.1  概述                  
             6.7.2  函數(shù)的聲明                  
             6.7.3  過濾器的聲明                  
             6.7.4  作用域                  
             6.7.5  聲明與賦值                  
             6.7.6  訪問                  
         6.8  N-Code數(shù)據(jù)包變量                  
             6.8.1  ethernet變量組                  
             6.8.2  fddi變量組                  
             6.8.3  icmp變量組                  
             6.8.4  ip變量組                  
             6.8.5  llc變量組                  
             6.8.6  packet變量組                  
             6.8.7  system變量組                  
             6.8.8  tcp變量組                  
             6.8.9  udp變量組                  
         6.9  N-Code異常                  
             6.9.1  長度異常                  
             6.9.2  校驗(yàn)和異常                  
             6.9.3  協(xié)議異常                  
             6.9.4  內(nèi)部異常                  
 第7章  NFR入侵檢測系統(tǒng)實(shí)例                  
         7.1  IDA系統(tǒng)的基本工作原理                  
             7.1.1  NFR IDA系統(tǒng)功能概述                  
             7.1.2  IDA系統(tǒng)環(huán)境構(gòu)成                  
             7.1.3  NFR IDA系統(tǒng)架構(gòu)                  
             7.1.4  IDA引擎組件                  
             7.1.5  后端組件                  
             7.1.6  警報(bào)                  
             7.1.7  查詢                  
             7.1.8  后臺進(jìn)程                  
             7.1.9  分布式環(huán)境中的應(yīng)用                  
         7.2  如何使用IDA系統(tǒng)                  
             7.2.1  啟動NFR IDA系統(tǒng)                  
             7.2.2  終止NFR IDA系統(tǒng)                  
             7.2.3  使用NFR控制臺                  
         7.3  查詢數(shù)據(jù)                  
             7.3.1  建立簡單查詢                  
             7.3.2  打印查詢結(jié)果                  
             7.3.3  限制查詢                  
             7.3.4  保存查詢                  
             7.3.5  載入查詢                  
             7.3.6  將數(shù)據(jù)導(dǎo)出到數(shù)據(jù)庫                  
             7.3.7  使用Perl查詢附件（Perl Query Add-on）                  
         7.4  查看警告                  
             7.4.1  概述                  
             7.4.2  理解警告組件                  
             7.4.3  使用警告查看器                  
         7.5  配置包與后端組件                  
             7.5.1  啟用包與后端組件                  
             7.5.2  禁用包與后端組件                  
             7.5.3  配置磁盤空間                  
             7.5.4  配置值                  
             7.5.5  添加包與后端組件                  
             7.5.6  刪除包或后端組件                  
         7.6  配置警告                  
             7.6.1  理解警告組                  
             7.6.2  改變警告規(guī)則                  
             7.6.3  建立新規(guī)則                  
         7.7  配置訪問控制                  
             7.7.1  理解訪問控制                  
             7.7.2  理解用戶管理                  
             7.7.3  設(shè)置權(quán)限                  
             7.7.4  配置用戶賬戶                  
         7.8  監(jiān)控IDA性能                  
             7.8.1  理解系統(tǒng)狀態(tài)報(bào)表                  
             7.8.2  查看系統(tǒng)歷史狀態(tài)                  
             7.8.3  查看系統(tǒng)狀態(tài)報(bào)表                  
         7.9  包與后端組件列表                  
             7.9.1  具有可配置值的后端組件                  
             7.9.2  郵件                  
             7.9.3  網(wǎng)絡(luò)統(tǒng)計(jì)                  
             7.9.4  網(wǎng)絡(luò)服務(wù)                  
             7.9.5  攻擊特征                  
             7.9.6  拒絕服務(wù)（DoS）檢測                  
             7.9.7  產(chǎn)品特定模塊                  
             7.9.8  入侵檢測                  
             7.9.9  掃描器                  
         7.10  理解數(shù)據(jù)類型                  
         7.11  術(shù)語表                  
     第8章  網(wǎng)絡(luò)入侵檢測系統(tǒng)的具體實(shí)現(xiàn)                  
         8.1  概述                  
             8.1.1  Snort系統(tǒng)概述                  
             8.1.2  系統(tǒng)程序架構(gòu)                  
         8.2  初始化. 主函數(shù)和命令行解析                  
             8.2.1  初始化. 主函數(shù)和命令行參數(shù)分析例程                  
             8.2.2  Snort使用方法                  
             8.2.3  PV數(shù)據(jù)結(jié)構(gòu)                  
             8.2.4  ParseCmdLine（325）                  
             8.2.5  SetPktProcessor（548）                  
             8.2.6  OpenPcap（666）                  
             8.2.7  主函數(shù)main（153）                  
             8.2.8  ProcessPacket（759）                  
         8.3  協(xié)議解析例程分析                  
             8.3.1  協(xié)議解析器（Decoder）例程                  
             8.3.2  Packet數(shù)據(jù)結(jié)構(gòu)（1243）                  
             8.3.3  DecodeEthPkt（1303）                  
             8.3.4  DecodePppPkt（1573）                  
             8.3.5  DecodeTRPkt（1395）                  
             8.3.6  DecodeNullPkt（1368）                  
             8.3.7  其他的數(shù)據(jù)鏈路層協(xié)議解析例程                  
             8.3.8  DecodeIP（1681）                  
             8.3.9  DecodeTCP（1800）                  
             8.3.10  DecodeUDP（1845）                  
             8.3.11  DecodeICMP（1877）                  
             8.3.12  DecodeARP（1916）                  
             8.3.13  DecodeIPV6（1935）. DecodeIPX（1951）                  
             8.3.14  DecodeTCPOptions（1967）                  
             8.3.15  DecodeIPOptions（2037）                  
         8.4  如何編寫Snort的規(guī)則                  
             8.4.1  規(guī)則頭                  
             8.4.2  規(guī)則選項(xiàng)                  
             8.4.3  預(yù)處理器                  
             8.4.4  輸出模塊                  
             8.4.5  高級規(guī)則概念                  
         8.5  規(guī)則解析例程分析                  
             8.5.1  規(guī)則（Rule）解析例程                  
             8.5.2  RuleTreeNode數(shù)據(jù)結(jié)構(gòu)（2162）                  
             8.5.3  OptTreeNode數(shù)據(jù)結(jié)構(gòu)（2142）                  
             8.5.4  RuleFpList（2129）. RuleOptList（2137）                  
             8.5.5  ListHead數(shù)據(jù)結(jié)構(gòu)（2182）                  
             8.5.6  mSplit（3210）                  
             8.5.7  ParseRulesFile（2224）                  
             8.5.8  規(guī)則解析器ParseRule（2287）                  
             8.5.9  規(guī)則鏈表頭處理例程ProcessHeadNode（2397）                  
             8.5.10  AddRuleFuncToList（2487）                  
             8.5.11  SetupRTNFuncList（2523）                  
             8.5.12  AddrToFunc（2563）和PortToFunc（2604）                  
             8.5.13  ParsePreprocessor（2681）                  
             8.5.14  ParseOutputPlugin（2749）                  
             8.5.15  ParseListFile（2895）                  
             8.5.16  CreateRule（2939）                  
             8.5.17  ParseRuleOptions（2966）                  
             8.5.18  ParseMessage（3110）                  
             8.5.19  ParseLogto（3147）                  
             8.5.20  ParseResponse（3178）                  
         8.6  檢測引擎例程分析                  
             8.6.1  檢測引擎（Detection Engine）例程                  
             8.6.2  Preprocess（3328）                  
             8.6.3  Detect（3351）                  
             8.6.4  EvalPacket（3398）                  
             8.6.5  EvalHeader（3453）                  
             8.6.6  EvalOpts（3501）                  
             8.6.7  CheckBidirectional（3534）                  
             8.6.8  CheckSrcIPEqual（3590）                  
             8.6.9  CheckSrcIPNotEq（3602）                  
             8.6.10  CheckDstIPEqual（3631）                  
             8.6.11  CheckDstIPNotEq（3649）                  
             8.6.12  CheckSrcPortEqual（3658）                  
             8.6.13  CheckSrcPortNotEq（3666）                  
             8.6.14  CheckDstPortEqual（3674）                  
             8.6.15  CheckDstPortNotEq（3682）                  
             8.6.16  CheckAddrPort（3698）                  
         8.7  插件模塊管理例程分析                  
             8.7.1  插件（Plugins）管理例程                  
             8.7.2  KeywordXlateList（3841）                  
             8.7.3  PreprocessKeywordList（3852）                  
             8.7.4  OutputKeywordList（3875）                  
             8.7.5  InitPlugins（3896）                  
             8.7.6  InitPreprocessors（3917）                  
             8.7.7  InitOutputPlugins（3929）                  
             8.7.8  RegisterPlugin（3951）                  
             8.7.9  SetupIcmpCodeCheck（4081）                  
             8.7.10  IcmpCodeCheckInit（4095）                  
             8.7.11  ParseIcmpCode（4118）                  
             8.7.12  IcmpCodeCheck（4152）                  
             8.7.13  SetupMinfrag（4169）                  
             8.7.14  MinfragInit（4173）                  
             8.7.15  ProcessMinfragArgs（4178）                  
             8.7.16  CheckMinfrag（4216）                  
             8.7.17  SetupFastAlert（4253）                  
             8.7.18  FastAlertInit（4265）                  
             8.7.19  SpoAlertFast（4275）                  
             8.7.20  ParseFastAlertArgs（4291）                  
             8.7.21  FastAlertCleanExitFunc（4308）和FastAlertRestartFunc（4315）                  
         8.8  預(yù)處理器插件模塊分析                  
             8.8.1  預(yù)處理器（Preprocessor）插件模塊                  
             8.8.2  PortList數(shù)據(jù)結(jié)構(gòu)（4323）                  
             8.8.3  http decode預(yù)處理器插件管理例程                  
             8.8.4  SetPorts（4362）                  
             8.8.5  預(yù)處理器主模塊PreprocUrlDecode（4387）                  
             8.8.6  一組用于端口掃描（Portscan）預(yù)處理器插件的數(shù)據(jù)結(jié)構(gòu)                  
             8.8.7  Portscan預(yù)處理器插件管理例程                  
             8.8.8  ParsePortscanArgs（4567）                  
             8.8.9  Portscanignorehosts預(yù)處理器插件管理例程                  
             8.8.10  CreateServerList（4640）                  
             8.8.11  預(yù)處理器主模塊PortscanPreprocFunction（4673）                  
             8.8.12  CheckTCPFlags（4784）                  
             8.8.13  ExpireConnections(4877)                  
             8.8.14  RemoveConnection（4955）                  
             8.8.15  NewScan（5041）                  
             8.8.16  NewConnection(5164)                  
             8.8.17  AddConnection（5206）                  
             8.8.18  ClearConnectionInfoFromSource（5272）                  
             8.8.19  LogScanInfoToSeparateFile（5303）                  
             8.8.20  AlertIntermediateInfo（5424）                  
             8.8.21  其他的連接管理例程                  
             8.8.22  幾個工具例程                  
         8.9  規(guī)則選項(xiàng)關(guān)鍵字插件模塊分析                  
             8.9.1  規(guī)則選項(xiàng)關(guān)鍵字（Keyword）插件模塊                  
             8.9.2  參數(shù)解析例程ParseDsize（5470）                  
             8.9.3  dsize插件模塊CheckDsizeGT（5505）. CheckDsizeLT（5515）和CheckDsizeEQ（5495）                  
             8.9.4  PatternMatchData數(shù)據(jù)結(jié)構(gòu)（5527）                  
             8.9.5  content插件管理例程                  
             8.9.6  參數(shù)解析例程ParsePattern（5646）                  
             8.9.7  content插件處理模塊CheckPatternMatch（5836）                  
     8.9.8  參數(shù)解析例程ParseSession（5914）                  
     8.9.9  session插件處理模塊LogSessionData（5934）                  
     8.9.10  DumpSessionData（5953）                  
     8.9.11  OpenSessionFile（5993）                  
     8.9.12  參數(shù)解析例程ParseIpOptionData（6082）                  
     8.9.13  ipoptions插件主處理模塊CheckIpOptions（6148）                  
     8.9.14  resp插件主模塊Respond（6165）                  
     8.9.15  SendICMP-UNREACH（6203）和SendTCPRST（6237）                  
     8.9.16  其他的選項(xiàng)關(guān)鍵字插件處理模塊                  
 8.10  輸出插件模塊分析                  
     8.10.1  輸出（Output）插件模塊                  
     8.10.2  主處理模塊AlertFast（6778）                  
     8.10.3  OpenAlertFile（6826）                  
     8.10.4  ProcessFileOption（6853）                  
     8.10.5  FastAlertCleanExitFunc（6881）和FastAlertRestartFunc（6888）                  
     8.10.6  主處理函數(shù)AlertFull（6921）                  
     8.10.7  PrintIPHeader（6971）                  
     8.10.8  參數(shù)解析例程ParseTcpdumpArgs（7108）                  
     8.10.9  TcpdumpInitLogFile（7129）                  
     8.10.10  主處理函數(shù)LogTcpdump（7154）                  
     8.10.11  pcap-dump-open（7160）和pcap-dump（7176）