Abstract
The network security is getting more awareness by public because the computers are network connected and there are increasing worms and network attacks in recent years. Some network devices are introduced to help increasing security, like firewalls and intrusion detection systems (IDS). But for IDS, previous works mostly focused on passive model, which aims at detections and alerting. But it is not enough to cope with current network threats. An active network IDS (ANIDS) would help to patch the rift.The thesis introduces that the main advantage of ANIDS is to stop attacks at first line and proactive defense. The ANIDS also has some limits like other security gateways and passive IDS. Several related works are surveyed, and a comparison among passive IDS, active IDS and other gateways is given. The issues of designing an ANIDS involve several considerations and trade-offs, such as performance and extensibility. The thesis presents a flexible, efficient, extensible framework for designing an ANIDS. An implementation based on this framework is developed on Linux 2.4 kernel. Performance and detection ability is compared with Hogwash.