基于Agent的入侵检测系统框架研究

The Research of the Architecture of Agent-Based Intrusion Detection System

文章在CIDF(通用入侵检测框架)的基础上,引入了静态智能Agent和移动Agent,提出了基于Agent的入侵检测系统框架的构想,采用静态智能Agent实现事件组件和分析组件的功能,采用移动Agent实现响应组件的功能。此框架的特点包括可扩展性、可动态配置、集成性、有效性、便于维护、升级和可自动响应等等,从而极大地改善了入侵检测系统的性能。

This article proposes an idea of agent-based intrusion detection system architecture by introducing intelligent agents and mobile agents based on CIDF(common intrusion detection framework).The authors use intelligent agents to implement event component and analyze component function and mobile agents to implement response component func-tion.This architecture is characterized of scalability,dynamic configuration,integration,availability,easy maintenance,up-grade and automatic response.Therefore,this architecture manages to improve the performance of intrusion detection sys-tem.