基于Agent的入侵检测系统体系结构设计

Architecture Design of an Agent-based Intrusion Detection System

提出并深入研究了一种基于智能体技术的入侵检测系统的体系结构。该体系结构是一种混合形结构,利用基于主机和基于网络的数据源,同时使用异常检测技术和误用检测技术。该体系结构中还引入数据挖掘的思想,利用数据挖掘技术从安全审计数据中提取关键的系统特征属性,根据这些属性生成安全审计数据的分类模型用于入侵检测,使IDS自动适应复杂多变的网络环境。

This thesis proposes a new architecture of the intrusion detection system (IDS) based on agents. To achieve better accuracy, the architecture adopts security audit data gathered from both host and network, and the architecture adopts a blend frame that makes use of both misuse detection approach and anomaly detection approach. Another highlight of the architecture is introduction of data mining technique. The IDS makes use of data mining algorithms to abstract key features of system runtime status from security audit data such as system log and network data stream, and then constructs classification engine of audit data. 