Intrusion detection system and method based on IPv6 network environment

Abstract

The invention provides an intrusion detection system (IDS) and a method based on IPv6 network environment. The system comprises a protocol set and rule base module, a data packet capture module, an IPV6 protocol analysis module, a protocol analysis and state tracking module, a rule analysis and packet detection module and a warning and logging module. The invention well solves the new problem of transplant of the IDS, brought about by the new IPv6 standards and characteristics, and improves the capture ability of the data packet, the detection means of the IDS and the safety detection abilityof the IDS.

Description

technical field [0001] The invention relates to the field of computer network information security, in particular to an intrusion detection system (IDS) and method based on the IPv6 network environment. Background technique [0002] With the rapid development of the Internet, network information has become an indispensable part of people's lives, and people pay more and more attention to network information security. Various intrusion events and attack methods against networks and hosts are emerging in an endless stream. It causes more people to invest in the research and development of Intrusion Detection System (IDS), which is mainly aimed at the shortcomings and deficiencies exposed by the most commonly used network intrusion prevention technology——firewall. [0003] Traditional network security technologies mainly include firewall technology, intrusion detection technology, encryption technology, authentication technology, virus protection technology, security audit tech...

AI Technical Summary

Problems solved by technology

[0007] First of all, there are loopholes in the implementation of the IPv6 protocol stack, which needs to be perfected in practice. For example, the OpenBSD and Cisco IOS system IPv6 protocol Type 0 routing header denial of service vulnerability, although the security factors have been considered in the design of the IPv6 protocol and aimed at these security factors. Some schemes have been designed, such as third-layer encryption and authentication, but the IPv6 network is not indestructible, at least it is still powerless against application-layer attacks;

[0008] Second, the loopholes caused by the transition mechanism from IPv4 to IPv6, etc. At present, security personnel have discovered some security loopholes that appear during the transition from IPv4 to IPv6. For example, hackers can illegally access LAN network resources using both IPv4 and IPv6 protocols. , the attacker can establish a tunnel from IPv6 to IPv4 through an IPv6 host with dual stack installed, thereby bypassing the firewall to attack IPv4;

[0009]Third, the network management technology under IPv6 is not mature enough to effectively monitor large-scale networks, which greatly limits the ability to control network security

At present, there is no IPv6-based intrusion detection system that can be used in practice. The research on IPv6-based intrusion detection system belongs to the international frontier field, which not only has good theoretical significance, but also has a very optimistic application prospect. With the development of the Internet, especially the popularization and application of IPv6, the intrusion detection system based on IPv6 will become the hot spot of Internet research and development and demand

Images