Multi-ISM联盟的网络安全系统协作模型及算法

Cooperation model and algorithm for network security system based on multi-ISM alliance

针对现有网络入侵检测系统(NIDS)存在智能程度低、自适应能力弱、协同性差、负载不均衡等局限性,引入了免疫软件人(ISM)智能体的理论,提出了一种基于multi-ISM联盟的网络入侵检测与防御系统的分布式社区协作控制模型及其算法.该模型系统采用了部分-全局规划(PGP)策略以及multi-ISM间的协作、协调和协商机制,融合了网络协作模型与层次模型的优点,从性能上改善了当前分布式入侵检测系统(DIDS)难以适应高带宽、大流量的动态网络环境等问题.实验结果表明:该模型系统相比其他的DIDS,在检测性能和误报率等方面具有明显优势,对于服务器系统资源的占用率不是很大,同时它还能够较好地解决网络信任社区内与社区间的协同防御和预警问题.

Existing network intrusion detection system（NIDS）has many disadvantages,such as lower intelligent,poor adaptive capacity,weak coordination and load balancing.Inspired by the intelligence recognition capability of immune-SoftMan（ISM）,a novel distributed community cooperation model and corresponding algorithm were thus proposed.The system model was based on multi-ISM alliance for the network intrusion detection and defense system（MISMNIDDS）.The partial-global planning（PGP）strategy was adopted by MISMNIDDS.Moreover,the cooperation,negotiation and coordination mechanism of autonomy ISM′s were possessed.The system model combined the merits of the level model and collaboration model,and could be self-updated locally to adapt to dynamic network environment.The results show that the MISMNIDDS is a self-organizing network security system.Compared with traditional DIDS,the MISMNIDDS possesses higher detection performance,lower false alarm rate and fewer server system resources.Furthermore,the MISMNIDDS enables member sites in the same trust community or different ones to resist attacks cooperatively.