《计算机安全》教学大纲

课程代码

045102091

课程名称

计算机安全

英文名称

Computer Security

课程类别

选修课

课程性质

选修

学时

总学时：48； 实验学时：16

学分

2.5

开课学期

第七学期（计算机科学与技术）；第五学期（网络工程）

开课单位

计算机科学与工程学院

适用专业

计算机科学与技术、网络工程

授课语言

中文

先修课程

计算机网络，操作系统，数据库

课程对毕业要求的支撑

本课程对学生达到毕业要求有如下贡献：

1.（工程知识）掌握扎实的计算机安全基础知识，掌握相关安全技术和工具，能够将工具应用于解决复杂的计算机安全问题。

2.（问题分析）能够应用计算机安全的基本原理和技术，并通过文献研究分析复杂的安全问题。

3.（设计/开发解决方案）能够设计针对复杂计算机安全问题的解决方案，或设计解决安全问题的工具。

4.（研究）能够针对计算机安全现状进行研究，提取和解决问题。

课程目标

使学生对计算机安全获得全面的理解和掌握，包括：了解计算机面临的主要安全威胁；掌握计算安全的基本概念、原理和方法；了解计算机安全系统的设计方法；并通过实践，提高动手能力，利用所学知识实施和构建安全防范体系和安全系统。

课程简介

计算机安全是一门实践性非常强的课程，通过理论和实验，能帮助学生理解计算机和网络系统安全的基本概念、主要技术和方法，熟悉计算机安全机制的设计、检测和分析，熟悉安全工具的使用，能进行系统和网络的安全分析和维护，具备信息安全防护的基本能力。

教学内容与学时分配

  1. 思政建设，1学时

重点：实现专业知识教学与立德树人教育的有机融合；激发学生“实干兴邦”的爱国奋斗精神。


（二）计算机安全概述，2学时

  1. 计算机安全面临的威胁，1学时

  2. 计算机安全目标和防御，1学时

重点及难点：

  1. 威胁的分类（计算系统的四种攻击）：截取、中断、篡改、伪造

  2. 计算机安全的三个目标：CIA

  3. 计算机安全的四个原则：最弱环节原则；最易渗透原则；适度保护原则；有效性原则


（三）密码编码学基础，3学时

  1. 常用密码算法，1学时

  1. 古典密码算法

  2. 对称密码算法

  3. 公钥密码算法

  1. 加密的应用，2学时

  1. 消息摘要

  2. 数字签名

  3. 密钥交换

  4. 证书

重点及难点：

（1）加密的两种基本设计方法：混乱和扩散

（2）对称密码算法和非对称密码算法的主要区别

（3）公钥密码的三种应用：加密/解密、数字签名、密钥交换


（四）网络安全，10学时

  1. 用户认证、访问控制，3学时

  1. 用户认证：四种认证方式

  2. 访问控制：定义、分类、计算机系统安全等级

  1. 入侵检测，3学时

  1. 入侵检测系统的定义和分类

  2. 入侵检测系统的部署

  1. 防火墙，4学时

  1. 包过滤型防火墙

  2. 状态检测包过滤型防火墙

  3. 应用代理型防火墙

  4. 防火墙部署

重点及难点：

（1）IPSec的3个主要协议的基本作用；IPSec的2种工作模式；安全关联

（2）SSL协议：SSL/TLS提供的安全服务；两个主要协议（SSL记录协议、SSL握手协议）的作用

（3）防火墙：防火墙的作用和存在的问题；包过滤、应用代理、状态检测防火墙及它们的基本原理；包过滤和状态检测的区别；包过滤和应用代理的区别

（4）入侵检测：入侵检测系统框架模型；入侵检测的分类；异常检测；误用检测


（五）程序安全，7学时

  1. 恶意代码，4学时

  1. 恶意代码的种类

  2. 计算机病毒：计算机病毒等特征、工作机制、传播机制

  3. 蠕虫：原理及实例

  4. 特洛伊木马：原理及实例

  1. 缓冲区溢出，3学时

  1. 缓冲区溢出：原理、实例讲解、预防方法

重点及难点：

  1. 缓冲区溢出攻击的原理；

  2. 蠕虫和病毒的区别；病毒的三种植入方式；病毒的分类

  3. 木马的原理


（六）数据库安全，5学时

  1. 数据库的安全性，2学时

  2. 数据库中典型攻击，3学时

  1. 统计推理攻击

  2. SQL注入攻击

重点及难点：

（1）数据库访问控制和操作系统的访问控制的区别

（2）敏感信息泄漏的类型

（3）推理攻击及防范


（七）操作系统安全，4学时

  1. 通用操作系统的保护，4学时

  1. 内存地址保护

  2. 一般对象的访问控制

  3. 文件保护

  4. 用户鉴别

重点及难点：

（1）操作系统的安全保护方法，4种分离控制方式

（2）一般对象的访问控制：文件目录；访问控制列表；访问控制矩阵；访问权能

（3）文件保护：UNIX的文件系统的保护：9比特访问控制模式；Unix中设置临时访问许可的方法（suid保护法）

（4）用户鉴别：Windows支持的认证方法；Unix口令加盐机制；一次性口令


实验教学（包括上机学时、实验学时、实践学时）

（一）利用CryptoAPI实现密码学的简单应用

1.实验目的

（1）掌握密码学的基本原理及密码学应用的基本原理

（2）了解微软加密服务体系结构以及CryptoAPI体系结构

（3）掌握CryptoAPI的使用方法，掌握加/解密、导入/导出密钥、签名/验证、消息摘要等函数的调用。

2.实验要求

开发的程序需要GUI图形用户界面，尽量将中间过程显示出来。

3.实验环境

密码函数库：CryptoAPI V2.0函数库

操作系统：支持CryptoAPI的系统，Windows 2000/XP

  C++编译器：Visual C++ 6.0/Visual studio 2008


（二）网络嗅探抓包工具的使用

1.实验目的

了解网络嗅探抓包工具Sniffer或Wireshark的主要功能，以及其能处理什么网络问题。下面以Sniffer为例展开实验内容及要求。

2.实验要求

掌握网络嗅探工具的使用

3.实验环境

操作系统：Windows 2000，Windows XP

工具：SnifferPro4.70.530


（三）缓冲区溢出实验

1.实验目的

（1）掌握缓冲区溢出原理

（2）了解基于堆栈的缓冲区溢出的调试方法

2.实验要求

（1）基本要求

编写一个能实现缓冲区溢出（堆栈溢出）的程序。或直接用“实验原理”中给出的“示例程序”。进行堆栈溢出分析。在调试状态下（如果使用的编程工具是VC，就可以使用VC自带的调试工具）查看寄存器和相应存储单元内容的变化情况。分析并解释缓冲区溢出的原因。 提交分析文档（要给出调试过程和运行过程中的一些必要的截图），源代码等。

（2）提高要求 

掌握利用堆栈溢出进行攻击的原理；学习shellcode的编写和调试技术；在上述溢出的情况下，改写ret地址，增加shellcode代码，实现利用缓冲区溢出的漏洞进行攻击。

3.实验环境

操作系统：Windows XP

编程语言：C++，其他语言也可（c，c#，java）


（四）Snort工具的使用

 1.实验目的

通过实验深入理解入侵检测系统与入侵防御系统的原理和工作方式，熟悉入侵检测系统snor，配置snort来使用规则集创建规则、给定指定攻击的特征。

 2.实验要求

提交实验报告，要求附上必要的截图说明实验过程。

 3.实验环境

操作系统： Windows XP

教学方法

课程教学以课堂教学、课外作业、综合讨论以及实验教学综合实施。

考核方式

本课程注重过程考核，考核形式、考核内容、课程目标、成绩比例为：

（1）平时作业、课堂表现、实验（占总成绩的30%）

根据学生平时上课和作业情况，已经完成实验报告的情况；

（2）期末考试（闭卷）（占总成绩的70%）

采用笔试闭卷方式，考试内容选择理论课程大部分内容，包含重点内容和小部分难点内容。

教材及参考书

现用教材：《计算机安全：原理与实践》，贾春福等译，机械工业出版社，2016.3，William Stallings 等著。

主要参考资料：

[1]《密码编码学与网络安全：原理与实践》（Cryptography and network security: principles and practices, Fourth Edition），孟庆树等译,电子工业出版社，2011.1，William Stallings著。

制定人及制定时间

徐玲玲，2019年4月10日


 “Computer Security”Syllabus

Course Code

045102091

Course Title

Computer Security

Course Category

Elective Course

Course Nature

Elective Course

Class Hours

48

Credits

2.5

Semester

 Fifth Semester，Seven Semester

Institute

School of Computer Science & Engineering

ProgramOriented

Computer Science and Technology, Network Engineering

Teaching Language

Chinese

Prerequisites

Computer Network、Operating System、Database

 Student Outcomes

 (Special Training Ability)

 This course has the following contributions to students' graduation requirements:

  1.  Engineering knowledge: master solid basic knowledge of computer security, related security technologies and tools, so as to solve complicated security problems.

  2.  Problem analysis: using the basic principles and techniques of computer security, combining with references, analyze complicated security problems.

  3.  Design/development solutions: design solutions or tools to the complicated security problems.

(4) Research: propose and solve problems after analyzing the research status of computer security.

Course Objectives

Train students to master a solid theoretical foundation of computer knowledge, understand the development of computer science knowledge and new technology, develop students' horizons, cultivate research ability and engineering practice ability, and cultivate students' practical ability and innovation ability.

Course Description

Computer security is a practical curriculum. Through the experiment, that can help students understand the basic concepts of computer and network system security and the main technology and method, familiar with computer security mechanism design, testing and analysis, familiar with the use of security tools, system and network security analysis and maintenance, have the basic ability of information security protection.

Teaching Content and Class Hours Distribution

 No.1  Ideological construction, 1 hour

 Key points: realize the organic integration of professional knowledge teaching and moral education; Inspire the students' patriotic struggle spirit of "making the country prosperous by doing" .


No.2  Computer Security Overview，2 hours

 1.Threats to computer security，1 hours

 2.Computer security goals and defense methods，1 hours

Highlights：

  1. The four attacks to the computing systems: the interception, tampering, forgery, interrupt

 (2)The three goals of computer security：CIA

 (3)The four principles of computer security: the weakest link principle; the most easily penetrating principle; appropriate protection principle; the principle of effectiveness.


No.3  Foundations of Cryptography，3 hours

 1..Cryptographic algorithms，1 hours

 (1)Classical cryptographic algorithms

 (2)symmetric cryptography algorithms

 (3)asymmetric cryptography algorithms

 2.The application of cryptography algorithms, 2 hours

 (1)The message digest

 (2)The digital signature

 (3)The key exchange

 (4)The certificate

Highlights：

 (1)Two basic design methods of encryption: confusion and diffusion

 (2)The main difference between symmetric cryptographic algorithms and asymmetric cryptographic algorithms

 (3)Three applications of public key cryptography: encryption / decryption, digital signature, and key exchange


No.4  Network security, 10 hours

 1.Authentication and access control，3 hours

 (1)Authentication

 (2)Access control

 2.Intrusion detection，3 hours

 (1)Framework model of universal intrusion detection system

 (2)Classification of intrusion detection

 3.Firewall，4 hours

 (1)Simple packet filter firewall

 (2)Stateful inspection packet filter firewall

 (3)Application proxy firewall

Highlights：

 (1)The basic function of three main protocols of IPSec; two working modes of IPSec;

 (2)SSL protocol: the security service provided by SSL/TLS; the function of two main protocols (SSL record protocol and SSL handshake protocol)

 (3)the role of the firewall and firewall problems; packet filter, application proxy, state inspection firewall and their basic principles; the differences between packet filtering and state detection; differences of packet filter and application proxy

 (4)IDS: intrusion detection system framework model; intrusion detection classification; anomaly detection; misuse detection


No.5  Program security，7 hours

 1. The malicious code，4 hours

 (1)The types of malicious code

 (2)Computer viruses: computer viruses, features, mechanisms

 (3)Trapdoor, Salamiattack, covert channel

 2. Buffer overflow，3 hours

Highlights：

  1. The principle of buffer overflow

 (2)The difference between a worm and a virus

 (3)Trapdoor, Salamiattack, covert channel


 No.6  Database security，5 hours

 1.Database security，2 hours

 (1)Data security requirements

 (2)Data integrity protection

 (3)Database sensitive data protection

 2.Typical attack in database，3 hours

 (1)Statistical reasoning attack

 (2)SQL injection attack

Highlights：

  1.  Database integrity: physical integrity, logical integrity, and element integrity

 (2)The difference between database access control and access control of operating systems

 (3)Types of sensitive information leakage

 (4)Reasoning attack and Prevention


No.7  The security of operating system，4 hours

 1.The protection of the general operating system，4 hours

 (1)The memory address protection

 (2)Access control for general objects

 (3)File protect

 (4)User authentication

Highlights：

 (1)Operating system security protection and separate control methods

 (2)Access control for general objects: file directories, access control lists, access control matrices, access capabilities

 (3)File protection: the protection of UNIX's file system: 9 bit access control mode; method for setting temporary access permission in Unix

 (4)User authentication: Window supported authentication methods, Unix password salt mechanism, one time password


Experimental Teaching

No.1 Using CryptoAPI to realize simple application of cryptology, 4 hours

1. Experimental purposes

(1) Grasp the basic principles of cryptography and its application

(2) Understand Microsoft Encryption Service Architecture and Crypto API Architecture

(3) Master the use of Crypto API, and the call of encryption/decryption, import/export key, signature/verification, message digest and other functions.

2. Experiments Requirements

The developed program needs GUI graphical user interface to display the intermediate process as much as possible.

3. Experimental environment

Crypto function library: CryptoAPI V2.0 function library

Operating System: Systems that support Crypto API, Windows 2000/XP

C++ Compiler: Visual C++ 6.0/Visual Studio 2008


No.2  The Use of network sniffing tool, 4 hours

1. Experimental purposes

Understand the main functions of Sniffer or Wireshark, a network sniffing tool, and what network problems it can handle. Next, take Sniffer as an example to expand the content and requirements of the experiment.

2. Experiments Requirements

Master the Use of Network Sniffing Tools

3. Experimental environment

Operating System: Windows 2000, Windows XP

Tool: Sniffer Pro 4.70.530


No.3  Buffer overflow experiment, 4 hours

1. Experimental purposes

(1) Master the Buffer Overflow Principle

(2) Understand stack-based buffer overflow debugging methods

2. Experiments requirements

(1) Basic requirements

Write a program that can implement buffer overflow (stack overflow). Or directly use the "sample program" given in the "experimental principle". Stack overflow analysis is performed. In the debugging state (if the programming tool used is VC, you can use the debugging tool provided by VC) to check the changes of registers and the corresponding storage unit contents. Analyse and explain the cause of buffer overflow. Submit analysis documents (some necessary screenshots of debugging and running processes), source code, etc.

(2) Improving requirements

Grasp the principle of using stack overflow to attack; learn the writing and debugging technology of shellcode; rewrite RET address and add shellcode code under the above overflow conditions, so as to exploit the vulnerability of buffer overflow to attack.

3. Experimental environment

Operating System: Windows XP

Programming language: C++, other languages can also (c, c#, java)


No.4  Use of Snort tools, 4 hours

1. Experimental purposes

Through experiments, we deeply understand the principles and working methods of intrusion detection system and intrusion prevention system, familiarize ourselves with intrusion detection system snor, configure snort to use rule set to create rules and give the characteristics of specified attacks.

2. Experiments requirements

The experimental report should be submitted with the necessary screenshots to illustrate the experimental process.

3. Experimental environment

Operating System: Windows XP

Teaching Method

The course teaching is carried out by classroom teaching, homework, comprehensive discussions and experimental teaching.

Examination Method

 This course focuses on the process assessment. The assessment form, assessment content, course objectives and achievement ratio are as follows:

 (1) Homework, class performance and experiments(30% of the total score)

 According to the students' homework, class performance and experiment reports;

 (2) Final exam (closed book) (70% of total score)

Adopt the written test closed method, select the main theory content, containing the key content and a little hard content.

Teaching Materials and Reference Books

Current teaching materials：

《Computer Security: Principles and Practice》,Translated by Jia Chunfu，Machinery Industry Press，2016.3，Written by William Stallings.

Main reference material：

[1]Cryptography and network security: principles and practices, Fourth Edition, Meng Shuqing, Publishing House of Electronics Industry, 2011.1, written by William Stallings.

Prepared by Whom and When

Xu Lingling, 10th April 2019


《计算机安全》实验教学大纲

课程代码

045102091

课程名称

计算机安全

英文名称

Computer Security

课程类别

选修课

课程性质

选修

学时

16

学分

2.5

开课学期

第五学期，第七学期

开课单位

计算机科学与工程学院

适用专业

网络工程，计算机科学与技术

授课语言

中文

先修课程

计算机网络，操作系统，数据库

毕业要求（专业培养能力）

本课程对学生达到毕业要求有如下贡献：

1.（工程知识）掌握扎实的计算机安全基础知识，掌握相关安全技术和工具，能够将工具应用于解决复杂的计算机安全问题。

2.（问题分析）能够应用计算机安全的基本原理和技术，并通过文献研究分析复杂的安全问题。

3.（设计/开发解决方案）能够设计针对复杂计算机安全问题的解决方案，或设计解决安全问题的工具。

4.（研究）能够针对计算机安全现状进行研究，提取和解决问题。

课程培养学生的能力（教学目标）

使学生对计算机安全获得全面的理解和掌握，包括：了解计算机面临的主要安全威胁；掌握计算安全的基本概念、原理和方法；了解计算机安全系统的设计方法；利用所学知识实施和构建安全防范体系和安全系统。

课程简介

通过以下实验，帮助学生掌握计算机安全的有关理论，原理，开发与使用相关技术。

1.利用CryptoAPI实现密码学的简单应用

2. 网络嗅探抓包工具的使用

3.缓冲区溢出实验

4. Snort工具的使用

主要仪器设备与软件

密码函数库：CryptoAPI V2.0函数库；操作系统：支持CryptoAPI的系统，Window s 2000/XP；C++编译器；Visual C++ 6.0/Visual studio 2008

实验报告

说明实验原理（理念）并进行方案选择，阐明为什么要选择这个实验方案以及所采用方案的特点。并重点说明实验是如何实现的，包括：对实验工作的详细表述。要求层次分明、表达确切。

考核方式

（1）本门实验课将结合出勤、实验操作以及实验报告等进行考核，其中出勤占实验课总评成绩的10%，实验操作占实验总评成绩的40%，实验报告占实验总评成绩的50%。

（2）本门实验课总评成绩占课程总评成绩的30%。

教材、实验指导书及教学参考书目

[1]王清贤等，《网络安全实验教程》，电子工业出版社，2016

[2]刘嘉勇，《信息安全技术实验教程》，四川大学出版社，2007

[3]曹晟，陈峥，《计算机网络安全实验教程》，清华大学出版社，2011

制定人及发布时间

徐玲玲，2019年5月5日


《计算机安全》实验教学内容与学时分配

实验项目编号

实验项目名称

实验学时

实验内容提要

实验类型

实验要求

每组人数

主要仪器设备与软件

1

利用CryptoAP实现密码学的简单应用

4

掌握密码学的基本原理及密码学应用的基本原理；了解微软加密服务体系结构以及CryptoAPI体系结构；掌握CryptoAPI的使用方法，掌握加/解密、导入/导出密钥、签名/验证、消息摘要等函数的调用。

通过对CryptoAPI的学习，掌握CryptoAPI在编程中的使用；用CryptoAPI加/解密文件；用CryptoAPI实现公开密钥加密；用CryptoAPI实现数字签名。

设计性

必做

1

密码函数库：CryptoAPI V2.0函数库；操作系统：支持CryptoAPI的系统，Windows 2000/XP；

C++编译器：Visual C++ 6.0/Visual studio 2008

2

网络嗅探抓包工具的使用

4

了解网络嗅探抓包工具sniffer（或Wireshark）的主要功能，以及其能处理什么网络问题。

用工具进行抓包协议分析，分析ARP攻击（ARP欺骗）实施过程。

验证性

必做

1

操作系统：Windows 2000，Windows XP；

工具：SnifferPro4.70.530（Wireshark2.4.1.0）

3

缓冲区溢出实验

4

掌握缓冲区溢出原理；了解基于堆栈的缓冲区溢出的调试方法。

编写一个能实现缓冲区溢出（堆栈溢出）的程序，在调试状态下查看寄存器和相应存储单元内容的变化情况。分析并解释缓冲区溢出的原因。掌握利用堆栈溢出进行攻击的原理，学习shellcode的编写和调试技术。

综合性

必做

1

操作系统：Windows XP；编程语言：C++，其他语言也可（c，c#，java）

4

Snort工具的使用

4

通过实验深入理解入侵检测系统与入侵防御系统的原理和工作方式，熟悉入侵检测系统snor，配置snort来使用规则集创建规则、给定指定攻击的特征。

综合性

选做

1

操作系统： Windows XP


 “Computer security” Syllabus

Course Code

045102091

Course Title

Computer Security

Course Category

Elective Courses

Course Nature

Elective Course

Class Hours

16

Credits

2.5

Semester

 Fifth Semester，Seven Semester

Institute

School of Computer Science & Engineering

Program Oriented

Computer Science and Technology, Network Engineering

Teaching Language

Chinese

Prerequisites

Computer Network、Operating System、Database

Student Outcomes (Special Training Ability)

 This course has the following contributions to students' graduation requirements:

 1. Engineering knowledge: master solid basic knowledge of computer security, related security technologies and tools, so as to solve complicated security problems.

 2. Problem analysis: using the basic principles and techniques of computer security, combining with references, analyze complicated security problems.

 3. Design/development solutions: design solutions or tools to the complicated security problems.

4. Research: propose and solve problems after analyzing the research status of computer security.

Teaching Objectives

Through experiments, we require students master the relevant theories and principles of computer security, and master the related technologies of computer secure development and application. Therefore, the content of the experiment is mainly combined with the above content.

Course Description

This course is an experimental course of computer security principles and techniques, which includes the following experiments:

1. Using CryptoAPI to realize simple application of cryptology;

2. The Use of network sniffing tool;

3. Buffer overflow experiment;

4. Use of Snort tools.

Instruments and Equipments

CryptoAPI V2.0； Window s 2000/XP/7； Visual C++ 6.0/Visual studio 2008


Experiment Report

Explain the experimental principle and scheme, and explain why we should choose the experimental scheme and the characteristics of the adopted scheme. It focuses on how the experiment is achieved, including a detailed description of the experiment. The requirements are clear and exact.

Assessment

1.  the experiment course will combine the attendance, experimental operation and experimental report assessment, including attendance grades experimental class accounted for 10%, accounting for the overall results of experiment 40%, experiment report for experimental grades 50%.

2.  the experiment course grades for courses grades 30%.

Teaching Materials and Reference Books

[1]Wang Qingxian,《Network Security Experiments》,Electronics industry Press, 2016

[2] Liu Jiayong,《Information Security Technology Experiments》,Sichuan University Press, 2007

[3] Cao Sheng, Chen Zheng，《Computer Network Security Experiments》, Tsinghua University Press, 2011

Prepared by Whom and When

Xu Lingling, 5th May 2019


 “Computer security” Experimental Teaching Arrangements

No.

Experiment Item

Class Hours

Content Summary

Category

Requirements

Number of StudentsEach Group

Instruments, Equipments and Software

1

Using CryptoAPI to realize the simple application of cryptography

4

Master the basic principle and application of cryptography; Microsoft encryption service architecture and CryptoAPI architecture; master the use of CryptoAPI master encryption/decryption, import/export key signature/verification, message digest function call.

Through the study of CryptoAPI, master the use of CryptoAPI in programming; encrypt/ decrypt files with CryptoAPI; implement public key encryption with CryptoAPI; implement digital signature with CryptoAPI.

Design

Compulsory

1

Cryptographic libraries: CryptoAPI V2.0 libraries; operating systems: systems that support CryptoAPI, Windows, 2000/XP;

C++ compiler: Visual C++ 6.0/Visual Studio 2008

2

Use of Sniffer（or Wireshark）

4

Understand the main functions of the well-known protocol analysis software sniffer (or Wireshark), and what network problems sniffer can handle.

Capture protocol analysis using sniffer, analysis of the ARP attack (ARP spoofing) implementation process.

Verification

Compulsory

1

Operating system: Windows 2000, Windows XP;

Tools: SnifferPro4.70.530（Wireshark2.4.1.0）

3

Buffer overflow

4

Grasp the principle of buffer overflow; understand the debug method of stack based buffer overflow.

Write a program to achieve buffer overflow (stack overflow), in the debug state to view the register and the corresponding storage unit content changes. Analyze and explain the reason for buffer overflow. Grasp the use of stack overflow attack principle, learning shellcode writing and debugging techniques.

Comprehensiveness

Compulsory

1

Operating system: Windows XP; programming language: C++, other languages can also be (C, c#, Java)

4

Use of Snort tools

4

Through experiments, we deeply understand the principles and working methods of intrusion detection system and intrusion prevention system, familiarize ourselves with intrusion detection system snor, configure snort to use rule set to create rules and give the characteristics of specified attacks.

Comprehensiveness

Elective

1

Operating system: Windows XP;