A general purpose application layer IDS

This article concentrates on the design and implementation of a general purpose application layer IDS (intrusion detection system). Being different from the traditional IDSs based on the network layer, this system can rebuild the TCP sessions and deal with different kinds of intrusions on the application layer. The whole process can be described briefly as: The system reassembles the IP packets captured by the sniffers, rebuilds the TCP sessions and provides a plug-in mechanism to process the data of different application layer protocols. Since the amount of the IP packets sniffed is very large, they are divided into different parts and send to multiple machines, where the packets are processed in parallel so that the system attains good performance, scalability, and stability. We have made some test on this system in a typical network environment and the results obtained show that the system is well designed.