基于蚁群算法实现入侵检测对动态网络拓扑的适应性  

Making IDS Adapt to Dynamic Network Topology Based on Ant Algorithms

作　　者：蒋嶷川[1] 张世永[1] 钟亦平[1] 

机构地区：[1]复旦大学计算机与信息技术系,上海200433

出　　处：《小型微型计算机系统》2005年第7期1167-1173,共7页Journal of Chinese Computer Systems

基　　金：国家"八六三"计划信息安全技术主题资助项目(2001AA142050)资助;国家信息安全关防项目(2001-研3-011);上海市科学型中小企业技术创新资金(种子资金)资助项目(0151H1312)

摘　　要：现有的入侵检测技术往往不能有效地适应网络拓扑结构的动态改变.针对这种情况,本文首先在蚁群算法的基础上提出了一种适应动态拓扑结构的入侵检测模型.在该模型中,以MobileAgentIDS为基础,引入Agent驻留因子概念,基于蚁群算法构造Agent的转移概率函数,使入侵检测Agent在网络拓扑结构发生变化以及系统被入侵时能根据实际的拓扑结构和入侵情况自适应地选择一条最优化的路径移动到一个最适合发挥其作用的位置,从而实现Agents的优化调配,获得入侵检测的拓扑结构自适应性.该模型符合Markov特性,论文采用概率论知识详细论述了单个Agent调配动作的Markov性质;然后采用随机Petri网论述了整体模型的Markov性质,并进行了性能评价.The traditional intrusion detection technology cant adapt itself to dynamic network topology, and cant exert its function well when the topology is transformed. Aiming at such problem, the paper provides an intrusion detection model based on ant colony algorithms that can adapt to dynamic network topology. In the provided model, we integrate mobile agent based IDS and the ant colony algorithms to construct the agent transition rule, and make intrusion detection agents to adaptively select an optimal path to move to the place where they can exert their functions well. Therefore, we can realize the optimal distribution of the agents and get the topology adaptation of intrusion detection technology. The provided model accords with Markov Chain character, the paper applies probability theory to analyze the Markov character of agent deploying and moving act; and the paper also applies Stochastic Petri Net to analyze the Markov character of the whole model and makes performance evaluation.

关 键 词：自适应性入侵检测 蚁群算法Markov链 网络拓扑结构 移动AGENT 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]