CAJ | 학술논문

计算机入侵检测已经成为安全领域中一个越来越重要的技术。入侵检测系统（IDS）通过收集和分析计算机网络系统的关键信息，并将违反安全策略的标志事件或攻击通知系统作出响应。据此，本文从入侵检测系统的基本框架出发，讨论基于网络的数据包捕获技术与分析技术，详细阐述入侵检测系统的总体设计过程，以及在Linux环境下采用Libpcap库函数提供的网络数据包捕获与分析函数实现数据包监测功能，并从代码的角度重点分析数据的捕获和处理方式，通过实验验证本文提出的关于网络数据包监测方法的可行性。
계산궤입침검측이경성위안전영역중일개월래월중요적기술。입침검측계통（IDS）통과수집화분석계산궤망락계통적관건신식，병장위반안전책략적표지사건혹공격통지계통작출향응。거차，본문종입침검측계통적기본광가출발，토론기우망락적수거포포획기술여분석기술，상세천술입침검측계통적총체설계과정，이급재Linux배경하채용Libpcap고함수제공적망락수거포포획여분석함수실현수거포감측공능，병종대마적각도중점분석수거적포획화처리방식，통과실험험증본문제출적관우망락수거포감측방법적가행성。
Intrusion detection technology for computer has become a more and more important technic in fields of security. IDS can collect and ana-lyze the key information of computer network system, and make response for the violation of security policy on marking the incident or at-tacks to notify system. Therefore, starts from the basic framework of IDS, discusses the capture technology and analysis technology based on network data packets. Also starts from the design process of IDS in details, and performs network data packet monitoring using the da-ta packet captured and analysis function of Libpcap Library under the environment of Linux, then from the view of code analyzes data captured and the processing method. Experiments show that this method is feasible and available.