分布式入侵检测系统通讯协议的研究与实现

Research and Implementation of Distributed Intrusion Detection System's Communication Pro tocol

文中提出并实现了基于安全套接字层(SSL)1技术和XML数据封装的分布式入侵检测系统(DIDS)安全通讯协议。SSL为网络应用层的通信提供了认证、数据保密和数据完整性的服务,较好地解决了数据传输的安全问题。XML具有良好的扩展性能,使用XML来定义入侵警报信息规范-IDMEF(IntrusionDetectionMessageExchangeFormat)2,进而使用栈结构来存储可以很容易地实现入侵警报信息的存取、检索。

This paper designs and implements a communication protocol which is based on Security Socked Layer(SSL)and used XML to package data,the protocol is used for a Distributed Intrusion Detection System(DIDS).SSL could en-sure mutual authentication,the confidentiality and integrity of the message content on the Network's Application Layer,so it can ensure the security of transferred data.IDS uses XML to define Intrusion Detection Message Exchange Format(IDMEF),which is a simple structure XML ,so it is easy to implement store and query intrusion alert message by stack structure.