Java 中的网络入侵检测系统..！
我计划用 Java 编程语言实现 NIDS（网络入侵检测系统）。
经过搜索，我找到了两个库。
1) Jpcap
2) jNetPcap
我应该使用哪一个，为什么？
使用哪个更优选？
I am planning on implementing a NIDS (Net Intrusion Detection System) in the Java programming language.
After searching, I found two libraries for this.
1) Jpcap
2) jNetPcap
Which one should I use and why?
Which is more preferable to use?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Jpcap 的开发似乎已经停止。他们的最后一个版本是 2007 年。相比之下，jNetPcap 已经发布了最近的版本。它们所包装的底层 libpcap C 库一直在不断发展，因此我会选择 jNetPcap。
另一方面，libpcap 是一个相当简单的 API。如果您熟悉 C，那么直接使用该库而不是通过 Java 包装器可能会获得性能优势。无论如何，需要考虑一些事情。
It appears development has stopped on Jpcap. Their last release was 2007. In contrast, jNetPcap has had very recent releases. The underlying libpcap C library that they both wrap has continued to evolve, so I would go with jNetPcap for that reason.
On the other hand, libpcap is a fairly simple API. If you are comfortable with C, then you may gain performance advantages by using the library directly instead of going through a Java wrapper. Something to consider, anyway.
对于网络入侵，我的一个简单想法是监听广播 IP 地址上的消息。网络新用户可能需要来自 DHCP 服务器的 IP 地址。如果是这样，那么他们将必须发出 DHCP 服务器将响应的广播。您可以编写一个位于客户端 A 上的程序，并在听到广播地址上的内容时显示弹出窗口。
One simple idea I've had for network intrusion was to listen for messages on the braodcast IP address. New comers to the network may likely need an IP address from the DHCP server. If this is so, then they will have to send out a broadcast that a DHCP server will respond to . You could write a program that sits on client A and displays popups whenever it hears something on the broadcast address.
如果问题仍然存在，请使用 .NET 版本 jnetpcap。我为硕士学期项目构建了一个 NIDS，并尝试使用 Java 并获得 jpcap 和类似的工作，但这几乎是不可能的。所以我选择了最可行的选项 c#，它工作起来更容易，即使我当时不知道。
还要使用 ikvm 因为您需要使用 weka.jar 也来自 .NET。
If it's still an issue, use .NET version jnetpcap. I built a NIDS for a master's term project and I tried to use Java and get jpcap and similar working but it was near impossible. So I went for the most viable option c# and it worked alot easier, even thought I didn't know it then.
Also use ikvm since you will need to use weka.jar from .NET as well.