Test device used for testing intrusion detection system and test method thereof

Abstract

The invention discloses a test device used for testing an intrusion detection system and a test method thereof. The test device comprises a network attack script generating module, a network attack script library module, a network attack script analyzing module, a network attack generating module and a reporting module. The test method comprises the steps as follows: (a) a network attack script is generated and is stored in a network attack script library; (b) an appointed script is selected from the network attack script library and is analyzed for getting a key parameter field of the network attack to prepare for regenerating an attack session; (c) related parameter obtained from step (b) is reconfigured, and a network attach session is established; and (d) a test report is generated according to the warning condition of an IDS or IDS module towards the network attack. The invention can realize the test towards the IDS or IDS module and in particular the test towards the IDS or IDS module which adopts a state protocol analyzing technology and can improve the efficiency and the accuracy of the test.

Description

technical field [0001] The invention belongs to the technical field of information security, and relates to the testing of network security products, in particular to a testing device and testing method for intrusion detection system (Intrusion Detection System, IDS for short) testing. Background technique [0002] Intrusion detection is a network security technology that provides real-time protection for computer networks. It mainly detects the data currently input into the protected network or protected host to determine whether the currently detected data is legal or illegal. Usually, the network intrusion detection system collects network communication information from several key points in the computer network system, such as the status and behavior of user activities, etc., and analyzes whether there is any violation of the security policy in the network through the established intrusion detection rule base. If a violation of the security policy is found, an alarm will...

AI Technical Summary

Problems solved by technology

[0006] 2. The attack signature packet is usually sent through a protocol analyzer, which generates a false network attack, not a complete network attack (only contains the attack signature field), and will not cause harm to the attack target. If the IDS or IDS module gives an alarm , which is a successful insertion and evasion attack (Insertion and Evasion Attack), indicating that there is a security flaw in the IDS or IDS module

Therefore, it is impossible to test such IDS or IDS modules simply by sending attack signature packets

[0007] 3. Recording and replaying can be performed through a protocol analyzer or a special testing tool. It re-injects historical network attack data into the network, but these data are network connections containing wrong fields (such as IP addresses, ports, time stamps, etc.) and serial number, etc.), it will not really cause harm, and it may also be an insertion and evasion attack. These data will be ignored by the attack target and the IDS or IDS module, so that the IDS or IDS that uses stateful protocol analysis technology cannot Modules are tested correctly

Images