基于管理代理的分布式入侵检测系统设计

Design and implementation of distributed intrusion detection system based on management agent

将网络管理系统与入侵检测系统相结合,建立基于管理代理的分布式入侵检测系统框架结构。研究管理代理的自治性、协同性以及管理代理间消息通信机制,建立管理代理的功能结构,设计基于遗传算法的调度Agent算法。从网络的各个层次分析管理信息库中与入侵检测有关的管理对象,建立检测规则库。完成分布式多层次结构化的具有自安全性的入侵检测系统的开发,达到管理代理对网络和主机监听目的。研究结果表明:根据攻击的本质特征,使用从管理信息库的统计数据中获取检测规则的方法,能有效实现对隐蔽和复杂攻击的检测。

Combined network management system with intrusion detection system（IDS）, the architecture of distributed intrusion detection system based on management agent was established. Good properties such as autonomy, cooperativity, communication mechanism among management agent were studied. Function structure of management agent was established and scheduling agent algorithm was also designed based on genetic algorithm. Management objects related to intrusion detection in management information base（MIB） were analyzed to form rules from different network levels. A distributed intrusion detection system with hierarchical structure and self-security was designed to monitor the running context of the system, and the rules were mined in intrusion detection from MIB according to the essence of network attack. The result shows that this method is efficient enough to meet the need of active detect complex intrusion.