无线局域网中的入侵检测系统研究

入侵检测系统对于保障无线局域网（WLAN）的安全十分重要。在深入分析当前WLAN安全问题中面临的主要问题后．针对无线局域网络的特点，提出并实现了一个分布式无线入侵检测系统。本系统根据无线网络攻击行为建立入侵特征库．利用Winpcap函数库对无线传输数据进行捕获，然后采用多模式匹配算法中的自动机匹配算法进行特征分析，理论分析和实验结果表明：本系统可实时检测War Driving入侵、非法AP、MAC地址欺骗等无线网络入侵行为，可用于无线局域网的某些安全应用中。

The Research of Intrusion Detection System Based on WLAN

Intrusion detection systems are one of the important ways to protect the security of wireless local area networks(WLANS). A new distribution wireless intrusion detection system is presented according to the characteristics of WLAN. After an intrusion characteristic libraries based on attacking behavior of the WLAN is builded and the Winpacap function is used to captures the wireless transmission data. An AC automaton matching algorithm analyses characteristics of the libraries. It is proved by theory and experiment that the new intrusion detection system can real time detect the wireless network intrusion behavior of War Driving, rogue AP and MAC address spoofing, and the new intrusion detection system can also be used to protect the security of WLANS in some fields.