基于移动Agent的分布式入侵检测系统研究

Mobile-agent-based Distributed Intrusion Detection System

随着网络信息量及速度的急剧上升,入侵检测技术必然也随之改变,分布式入侵检测就是一个好的选择。本文构建出一个基于移动Agent分布式入侵检测模型;探讨了该模型的实现并对其性能进行了仿真实验验证。该模型采用"域内集中处理,域间互助协作"的工作方式,将整个受保护的网络划分成若干个域,每个域内是一个完整的中心分析型分布式入侵检测系统,域间地位平等,互相协作,共同完成分布式入侵检测。这样以来,既能克服单点故障问题,又便于管理,容易分析判别是本地攻击还是分布式攻击。

This paper builds a model of Distributed Intrusion Detection System Based on mobile Agent and discusses the realiza- tion of the model, and simulation tests are carried out about its properties. The model takes the working method of ＂Collective disposition within a domain and mutual cooperation among domains＂. The protected network is divided into a number of do- mains, and each of them is a complete analysis center of distributed intrusion detection system. These domains have relatively equal positions, mutually cooperate, and complete distributed intrusion detection together. In this way, single point failures can be overcome, management becomes easy, and it is easily analyzed and discriminated whether the attack is locally aggressive or distributed.