網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)

第1章  概述                  
 1.1  入侵檢測(cè)系統(tǒng)的組成部分                  
 1.2  濫用入侵檢測(cè)系統(tǒng)                  
 1.3  非規(guī)則入侵檢測(cè)系統(tǒng)                  
 1.4  兩種分析技術(shù)的比較                  
 1.5  入侵檢測(cè)系統(tǒng)的層次體系                  
 1.6  進(jìn)一步發(fā)展的若干方向                  
     1.6.1  寬帶高速網(wǎng)絡(luò)的實(shí)時(shí)入侵檢測(cè)技術(shù)                  
     1.6.2  大規(guī)模分布式入侵檢測(cè)技術(shù)                  
     1.6.3  入侵檢測(cè)的數(shù)據(jù)融合技術(shù)                  
     1.6.4  先進(jìn)檢測(cè)算法的應(yīng)用                  
 1.7  面臨的挑戰(zhàn)                  
     第2章  網(wǎng)絡(luò)編程基礎(chǔ)知識(shí)                  
         2.1  分層協(xié)議模型                  
         2.2  開(kāi)放系統(tǒng)互聯(lián)參考模型OSI/ISO                  
         2.3  TCP/IP參考模型                  
         2.4  UNIX網(wǎng)絡(luò)編程技術(shù)概述                  
         2.5  TCP/IP協(xié)議                  
             2.5.1  網(wǎng)絡(luò)接口層協(xié)議                  
             2.5.2  ARP協(xié)議和RARP協(xié)議                  
             2.5.3  IP協(xié)議                  
             2.5.4  ICMP協(xié)議                  
             2.5.5  TCP協(xié)議                  
             2.5.6  UDP協(xié)議                  
     第3章  網(wǎng)絡(luò)數(shù)據(jù)包截獲機(jī)制分析                  
         3.1  基本的網(wǎng)絡(luò)數(shù)據(jù)包截獲機(jī)制                  
         3.2  高效的數(shù)據(jù)包截獲/過(guò)濾機(jī)制                  
             3.2.1  概述                  
             3.2.2  BPF的工作原理                  
             3.2.3  BPF虛擬機(jī)的實(shí)現(xiàn)                  
             3.2.4  BPF程序源代碼                  
         3.3  數(shù)據(jù)包截獲的Libpcap庫(kù)函數(shù)接口                  
             3.3.1  概述                  
             3.3.2  Libpcap庫(kù)函數(shù)接口                  
             3.3.3  采用Libpcap庫(kù)的數(shù)據(jù)包截獲實(shí)例                  
     第4章  入侵檢測(cè)引擎的設(shè)計(jì)                  
         4.1  IDES系統(tǒng)概述                  
             4.1.1  什么是IDES系統(tǒng)                  
             4.1.2  IDES的系統(tǒng)設(shè)計(jì)                  
             4.1.3  IDES的審計(jì)記錄格式                  
         4.2  用于入侵檢測(cè)的統(tǒng)計(jì)分析測(cè)量值                  
             4.2.1  用戶測(cè)量值                  
             4.2.2  目標(biāo)系統(tǒng)                  
             4.2.3  遠(yuǎn)程主機(jī)                  
         4.3  基于統(tǒng)計(jì)分析的分析算法                  
             4.3.1  IDES分?jǐn)?shù)值（score）                  
             4.3.2  分?jǐn)?shù)值T2如何從單個(gè)測(cè)量值獲得                  
             4.3.3  單個(gè)測(cè)量值類(lèi)型                  
             4.3.4  S與Q聯(lián)系的啟發(fā)式描述                  
             4.3.5  從Q計(jì)算S的算法                  
             4.3.6  計(jì)算Q的頻率分布                  
             4.3.7  計(jì)算活動(dòng)強(qiáng)度測(cè)量值的Q值                  
             4.3.8  計(jì)算審計(jì)記錄分布測(cè)量值的Q值                  
             4.3.9  計(jì)算類(lèi)別測(cè)量值的統(tǒng)計(jì)值Q                  
             4.3.10  計(jì)算序數(shù)測(cè)量值的Q值                  
         4.4  相關(guān)的數(shù)據(jù)結(jié)構(gòu)及函數(shù)接口                  
             4.4.1  數(shù)據(jù)結(jié)構(gòu)                  
             4.4.2  函數(shù)接口                  
     第5章  專家系統(tǒng)的應(yīng)用                  
         5.1  概述                  
         5.2  由一個(gè)簡(jiǎn)單實(shí)例開(kāi)始                  
         5.3  PBEST的基本語(yǔ)法                  
         5.4  更詳細(xì)的語(yǔ)法介紹                  
         5.5  專家系統(tǒng)的外部接口                  
         5.6  一個(gè)示例Makefile                  
         5.7  PBEST語(yǔ)法圖表                  
         5.8  帶參數(shù)的pbcc調(diào)用                  
     第6章  入侵檢測(cè)規(guī)則語(yǔ)言的設(shè)計(jì)                  
         6.1  概述                  
         6.2  N-Code語(yǔ)言的詞法元素                  
             6.2.1  字符集                  
             6.2.2  注釋                  
             6.2.3  運(yùn)算符                  
             6.2.4  變量                  
             6.2.5  保留字                  
             6.2.6  常量                  
         6.3  N-Code語(yǔ)言的數(shù)據(jù)類(lèi)型                  
             6.3.1  概述                  
             6.3.2  array                  
             6.3.3  ethmac                  
             6.3.4  error                  
             6.3.5  int                  
             6.3.6  ipv4host                  
             6.3.7  ipv4net                  
             6.3.8  list                  
             6.3.9  recorder                  
             6.3.10  str                  
             6.3.11  pattern                  
         6.4  N-Code的表達(dá)式                  
             6.4.1  概述                  
             6.4.2  算術(shù)運(yùn)算符                  
             6.4.3  賦值運(yùn)算符                  
             6.4.4  位運(yùn)算符                  
             6.4.5  邏輯運(yùn)算符                  
             6.4.6  關(guān)系運(yùn)算符                  
             6.4.7  其他運(yùn)算符                  
         6.5  N-Code語(yǔ)句                  
             6.5.1  概述                  
             6.5.2  assignment                  
             6.5.3  block                  
             6.5.4  break                  
             6.5.5  declare                  
             6.5.6  expression                  
             6.5.7  foreach                  
             6.5.8  If                  
             6.5.9  off                  
             6.5.10  on                  
             6.5.11  record                  
             6.5.12  requires                  
             6.5.13  return                  
             6.5.14  while                  
         6.6  N-Code中的函數(shù)                  
         6.7  N-Code中的函數(shù)聲明                  
             6.7.1  概述                  
             6.7.2  函數(shù)的聲明                  
             6.7.3  過(guò)濾器的聲明                  
             6.7.4  作用域                  
             6.7.5  聲明與賦值                  
             6.7.6  訪問(wèn)                  
         6.8  N-Code數(shù)據(jù)包變量                  
             6.8.1  ethernet變量組                  
             6.8.2  fddi變量組                  
             6.8.3  icmp變量組                  
             6.8.4  ip變量組                  
             6.8.5  llc變量組                  
             6.8.6  packet變量組                  
             6.8.7  system變量組                  
             6.8.8  tcp變量組                  
             6.8.9  udp變量組                  
         6.9  N-Code異常                  
             6.9.1  長(zhǎng)度異常                  
             6.9.2  校驗(yàn)和異常                  
             6.9.3  協(xié)議異常                  
             6.9.4  內(nèi)部異常                  
 第7章  NFR入侵檢測(cè)系統(tǒng)實(shí)例                  
         7.1  IDA系統(tǒng)的基本工作原理                  
             7.1.1  NFR IDA系統(tǒng)功能概述                  
             7.1.2  IDA系統(tǒng)環(huán)境構(gòu)成                  
             7.1.3  NFR IDA系統(tǒng)架構(gòu)                  
             7.1.4  IDA引擎組件                  
             7.1.5  后端組件                  
             7.1.6  警報(bào)                  
             7.1.7  查詢                  
             7.1.8  后臺(tái)進(jìn)程                  
             7.1.9  分布式環(huán)境中的應(yīng)用                  
         7.2  如何使用IDA系統(tǒng)                  
             7.2.1  啟動(dòng)NFR IDA系統(tǒng)                  
             7.2.2  終止NFR IDA系統(tǒng)                  
             7.2.3  使用NFR控制臺(tái)                  
         7.3  查詢數(shù)據(jù)                  
             7.3.1  建立簡(jiǎn)單查詢                  
             7.3.2  打印查詢結(jié)果                  
             7.3.3  限制查詢                  
             7.3.4  保存查詢                  
             7.3.5  載入查詢                  
             7.3.6  將數(shù)據(jù)導(dǎo)出到數(shù)據(jù)庫(kù)                  
             7.3.7  使用Perl查詢附件（Perl Query Add-on）                  
         7.4  查看警告                  
             7.4.1  概述                  
             7.4.2  理解警告組件                  
             7.4.3  使用警告查看器                  
         7.5  配置包與后端組件                  
             7.5.1  啟用包與后端組件                  
             7.5.2  禁用包與后端組件                  
             7.5.3  配置磁盤(pán)空間                  
             7.5.4  配置值                  
             7.5.5  添加包與后端組件                  
             7.5.6  刪除包或后端組件                  
         7.6  配置警告                  
             7.6.1  理解警告組                  
             7.6.2  改變警告規(guī)則                  
             7.6.3  建立新規(guī)則                  
         7.7  配置訪問(wèn)控制                  
             7.7.1  理解訪問(wèn)控制                  
             7.7.2  理解用戶管理                  
             7.7.3  設(shè)置權(quán)限                  
             7.7.4  配置用戶賬戶                  
         7.8  監(jiān)控IDA性能                  
             7.8.1  理解系統(tǒng)狀態(tài)報(bào)表                  
             7.8.2  查看系統(tǒng)歷史狀態(tài)                  
             7.8.3  查看系統(tǒng)狀態(tài)報(bào)表                  
         7.9  包與后端組件列表                  
             7.9.1  具有可配置值的后端組件                  
             7.9.2  郵件                  
             7.9.3  網(wǎng)絡(luò)統(tǒng)計(jì)                  
             7.9.4  網(wǎng)絡(luò)服務(wù)                  
             7.9.5  攻擊特征                  
             7.9.6  拒絕服務(wù)（DoS）檢測(cè)                  
             7.9.7  產(chǎn)品特定模塊                  
             7.9.8  入侵檢測(cè)                  
             7.9.9  掃描器                  
         7.10  理解數(shù)據(jù)類(lèi)型                  
         7.11  術(shù)語(yǔ)表                  
     第8章  網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)的具體實(shí)現(xiàn)                  
         8.1  概述                  
             8.1.1  Snort系統(tǒng)概述                  
             8.1.2  系統(tǒng)程序架構(gòu)                  
         8.2  初始化. 主函數(shù)和命令行解析                  
             8.2.1  初始化. 主函數(shù)和命令行參數(shù)分析例程                  
             8.2.2  Snort使用方法                  
             8.2.3  PV數(shù)據(jù)結(jié)構(gòu)                  
             8.2.4  ParseCmdLine（325）                  
             8.2.5  SetPktProcessor（548）                  
             8.2.6  OpenPcap（666）                  
             8.2.7  主函數(shù)main（153）                  
             8.2.8  ProcessPacket（759）                  
         8.3  協(xié)議解析例程分析                  
             8.3.1  協(xié)議解析器（Decoder）例程                  
             8.3.2  Packet數(shù)據(jù)結(jié)構(gòu)（1243）                  
             8.3.3  DecodeEthPkt（1303）                  
             8.3.4  DecodePppPkt（1573）                  
             8.3.5  DecodeTRPkt（1395）                  
             8.3.6  DecodeNullPkt（1368）                  
             8.3.7  其他的數(shù)據(jù)鏈路層協(xié)議解析例程                  
             8.3.8  DecodeIP（1681）                  
             8.3.9  DecodeTCP（1800）                  
             8.3.10  DecodeUDP（1845）                  
             8.3.11  DecodeICMP（1877）                  
             8.3.12  DecodeARP（1916）                  
             8.3.13  DecodeIPV6（1935）. DecodeIPX（1951）                  
             8.3.14  DecodeTCPOptions（1967）                  
             8.3.15  DecodeIPOptions（2037）                  
         8.4  如何編寫(xiě)Snort的規(guī)則                  
             8.4.1  規(guī)則頭                  
             8.4.2  規(guī)則選項(xiàng)                  
             8.4.3  預(yù)處理器                  
             8.4.4  輸出模塊                  
             8.4.5  高級(jí)規(guī)則概念                  
         8.5  規(guī)則解析例程分析                  
             8.5.1  規(guī)則（Rule）解析例程                  
             8.5.2  RuleTreeNode數(shù)據(jù)結(jié)構(gòu)（2162）                  
             8.5.3  OptTreeNode數(shù)據(jù)結(jié)構(gòu)（2142）                  
             8.5.4  RuleFpList（2129）. RuleOptList（2137）                  
             8.5.5  ListHead數(shù)據(jù)結(jié)構(gòu)（2182）                  
             8.5.6  mSplit（3210）                  
             8.5.7  ParseRulesFile（2224）                  
             8.5.8  規(guī)則解析器ParseRule（2287）                  
             8.5.9  規(guī)則鏈表頭處理例程ProcessHeadNode（2397）                  
             8.5.10  AddRuleFuncToList（2487）                  
             8.5.11  SetupRTNFuncList（2523）                  
             8.5.12  AddrToFunc（2563）和PortToFunc（2604）                  
             8.5.13  ParsePreprocessor（2681）                  
             8.5.14  ParseOutputPlugin（2749）                  
             8.5.15  ParseListFile（2895）                  
             8.5.16  CreateRule（2939）                  
             8.5.17  ParseRuleOptions（2966）                  
             8.5.18  ParseMessage（3110）                  
             8.5.19  ParseLogto（3147）                  
             8.5.20  ParseResponse（3178）                  
         8.6  檢測(cè)引擎例程分析                  
             8.6.1  檢測(cè)引擎（Detection Engine）例程                  
             8.6.2  Preprocess（3328）                  
             8.6.3  Detect（3351）                  
             8.6.4  EvalPacket（3398）                  
             8.6.5  EvalHeader（3453）                  
             8.6.6  EvalOpts（3501）                  
             8.6.7  CheckBidirectional（3534）                  
             8.6.8  CheckSrcIPEqual（3590）                  
             8.6.9  CheckSrcIPNotEq（3602）                  
             8.6.10  CheckDstIPEqual（3631）                  
             8.6.11  CheckDstIPNotEq（3649）                  
             8.6.12  CheckSrcPortEqual（3658）                  
             8.6.13  CheckSrcPortNotEq（3666）                  
             8.6.14  CheckDstPortEqual（3674）                  
             8.6.15  CheckDstPortNotEq（3682）                  
             8.6.16  CheckAddrPort（3698）                  
         8.7  插件模塊管理例程分析                  
             8.7.1  插件（Plugins）管理例程                  
             8.7.2  KeywordXlateList（3841）                  
             8.7.3  PreprocessKeywordList（3852）                  
             8.7.4  OutputKeywordList（3875）                  
             8.7.5  InitPlugins（3896）                  
             8.7.6  InitPreprocessors（3917）                  
             8.7.7  InitOutputPlugins（3929）                  
             8.7.8  RegisterPlugin（3951）                  
             8.7.9  SetupIcmpCodeCheck（4081）                  
             8.7.10  IcmpCodeCheckInit（4095）                  
             8.7.11  ParseIcmpCode（4118）                  
             8.7.12  IcmpCodeCheck（4152）                  
             8.7.13  SetupMinfrag（4169）                  
             8.7.14  MinfragInit（4173）                  
             8.7.15  ProcessMinfragArgs（4178）                  
             8.7.16  CheckMinfrag（4216）                  
             8.7.17  SetupFastAlert（4253）                  
             8.7.18  FastAlertInit（4265）                  
             8.7.19  SpoAlertFast（4275）                  
             8.7.20  ParseFastAlertArgs（4291）                  
             8.7.21  FastAlertCleanExitFunc（4308）和FastAlertRestartFunc（4315）                  
         8.8  預(yù)處理器插件模塊分析                  
             8.8.1  預(yù)處理器（Preprocessor）插件模塊                  
             8.8.2  PortList數(shù)據(jù)結(jié)構(gòu)（4323）                  
             8.8.3  http decode預(yù)處理器插件管理例程                  
             8.8.4  SetPorts（4362）                  
             8.8.5  預(yù)處理器主模塊PreprocUrlDecode（4387）                  
             8.8.6  一組用于端口掃描（Portscan）預(yù)處理器插件的數(shù)據(jù)結(jié)構(gòu)                  
             8.8.7  Portscan預(yù)處理器插件管理例程                  
             8.8.8  ParsePortscanArgs（4567）                  
             8.8.9  Portscanignorehosts預(yù)處理器插件管理例程                  
             8.8.10  CreateServerList（4640）                  
             8.8.11  預(yù)處理器主模塊PortscanPreprocFunction（4673）                  
             8.8.12  CheckTCPFlags（4784）                  
             8.8.13  ExpireConnections(4877)                  
             8.8.14  RemoveConnection（4955）                  
             8.8.15  NewScan（5041）                  
             8.8.16  NewConnection(5164)                  
             8.8.17  AddConnection（5206）                  
             8.8.18  ClearConnectionInfoFromSource（5272）                  
             8.8.19  LogScanInfoToSeparateFile（5303）                  
             8.8.20  AlertIntermediateInfo（5424）                  
             8.8.21  其他的連接管理例程                  
             8.8.22  幾個(gè)工具例程                  
         8.9  規(guī)則選項(xiàng)關(guān)鍵字插件模塊分析                  
             8.9.1  規(guī)則選項(xiàng)關(guān)鍵字（Keyword）插件模塊                  
             8.9.2  參數(shù)解析例程ParseDsize（5470）                  
             8.9.3  dsize插件模塊CheckDsizeGT（5505）. CheckDsizeLT（5515）和CheckDsizeEQ（5495）                  
             8.9.4  PatternMatchData數(shù)據(jù)結(jié)構(gòu)（5527）                  
             8.9.5  content插件管理例程                  
             8.9.6  參數(shù)解析例程ParsePattern（5646）                  
             8.9.7  content插件處理模塊CheckPatternMatch（5836）                  
     8.9.8  參數(shù)解析例程ParseSession（5914）                  
     8.9.9  session插件處理模塊LogSessionData（5934）                  
     8.9.10  DumpSessionData（5953）                  
     8.9.11  OpenSessionFile（5993）                  
     8.9.12  參數(shù)解析例程ParseIpOptionData（6082）                  
     8.9.13  ipoptions插件主處理模塊CheckIpOptions（6148）                  
     8.9.14  resp插件主模塊Respond（6165）                  
     8.9.15  SendICMP-UNREACH（6203）和SendTCPRST（6237）                  
     8.9.16  其他的選項(xiàng)關(guān)鍵字插件處理模塊                  
 8.10  輸出插件模塊分析                  
     8.10.1  輸出（Output）插件模塊                  
     8.10.2  主處理模塊AlertFast（6778）                  
     8.10.3  OpenAlertFile（6826）                  
     8.10.4  ProcessFileOption（6853）                  
     8.10.5  FastAlertCleanExitFunc（6881）和FastAlertRestartFunc（6888）                  
     8.10.6  主處理函數(shù)AlertFull（6921）                  
     8.10.7  PrintIPHeader（6971）                  
     8.10.8  參數(shù)解析例程ParseTcpdumpArgs（7108）                  
     8.10.9  TcpdumpInitLogFile（7129）                  
     8.10.10  主處理函數(shù)LogTcpdump（7154）                  
     8.10.11  pcap-dump-open（7160）和pcap-dump（7176）