基于免疫Agent的网络入侵检测系统

Intrusion Detection System Based on Immune Agent

结合计算机免疫学原理和多Agent技术构建了一个网络化、分布式、智能化的入侵检测系统,该系统融合了两者的优势,同时继承了多Agent系统和免疫系统的优点。其特点是能同时进行多层次的监测和不同级别的响应。系统是完全分布式结构,监视Agent生成后在网络上漫游,各个Agent分布在网络的各个结点上,单个结点受到攻击不会影响其他结点的检测能力,避免了单点失效问题。将疫苗概念引入系统,使得各个Agent可以实现互相学习,增强了整个网络的耐受性、"记忆"机制及新抗体生成机制的能力,提高了系统的适应性,不仅能检测到已知的攻击,而且还能检测到未知的攻击。

A new intrusion detection system （IDS） based on immune agent was presented. It combines multi-agent technology with immune principles, a concept of immune agent was also presented. Compared with the traditional system, this system is flexible, distributed, intelligent and so on. In this system, scout agents, which are based on immunity, roam around the nodes, and monitor the situation in the network at different levels, including the user level, system level, process level and packet level. These scout agents can learn and adapt to the environment dynamically. This system model possesses characteristics such as distribution, robustness, intelligent nature and adaptability etc, the adaptability and other characteristics network security system are increased. This system not only detects the given intrusions, but also the unknown intrusions.