Python编写的基于规则的网络入侵检测系统

import re

# 定义规则
rules = [
    {'name': 'DNS exfiltration', 'pattern': '^[a-z]+[.][a-z]+[.][a-z]+\.?[a-z]*[.]*[a-z]*$'},
    {'name': 'SQL injection', 'pattern': "['|\"]*OR.*=.*['|\"]*[0-9]*[^\w\s]*$"},
    {'name': 'XSS', 'pattern': '<[a-zA-Z]+.*[sS][rR][cC]=["][^"]+["].*[>]*$'}
]

# 定义检测函数
def detect_threat(packet):
    for rule in rules:
        match = re.search(rule['pattern'], packet)
        if match:
            print('Threat detected: {} in {}'.format(rule['name'], packet))
            return True
    return False

# 测试数据
packets = [
    'www.google.com',
    'pidancode.com',
    'select * from users where ID=1 OR 1=1',
    '<img src="http://www.example.com/image.jpg">',
    '<script src="http://malicious.com/malware.js"></script>'
]

# 测试检测函数
for packet in packets:
    detect_threat(packet)