一种基于邻近距离的分布式入侵防御系统模型

Distributed IPS Model Based on Near Neighbor Distance

分析了现有入侵防御系统的体系结构及存在的主要问题;根据入侵防御系统的特点,提出了一种基于邻近距离的分布式入侵防御系统(Intrusion Prevention System,IPS)模型。模型定义了系统中的消息类型,采用基于消息的协作方式可增强系统部署的灵活性,通过计算节点间的邻近距离优化通信范围,并给出相应的消息转发策略,以减少系统的消息量。实验表明,模型可以显著减少分布式入侵防御系统的网络负载。

The characteristics and problems of Intrusion Prevention System （IPS） architecture were analyzed.and a distributed IPS model based on near neighbor distance was proposed in this paper. In the model, message types transmitted between cooperation nodes were defined, and a message-based cooperation method was adopted to enhance the flexibility for system deployment. In order to reduce the redundant message, the distance between nodes was calculated and the communication region was optimized in the model. The experimental results show that the model decreases the IPS network load evidently.