分层协作的多代理入侵检测系统  

Layered Cooperating Intrusion Detection System Based on Multi-Agent

作　　者：吕爱丽[1] 魏海平[1] 王福威[1] 叶小涛[1] 

机构地区：[1]辽宁石油化工大学信息工程学院,辽宁抚顺113001

出　　处：《辽宁石油化工大学学报》2005年第3期71-75,共5页Journal of Liaoning Petrochemical University

摘　　要：根据分布式入侵检测系统的设计策略,设计了一个分层协作的多代理入侵检测系统。引入分层协作机制的目的是为了克服单一的主机入侵检测系统以及网络入侵检测系统的某些缺陷。通过各个节点之间的协同工作,共同检测和防范对系统的入侵行为。系统框架参考目前流行的通用入侵检测框架CIDF构建。检测方法采用协议分析融合模式匹配的方式。介绍了系统的体系结构,各部分的功能以及系统实现的一些关键技术。According to the design tactics of distributed intrusion detection system, a Layered Cooperation Intrusion Detection System （IDS） based on the multi - agent technology was designed. The main aim in layered cooperating IDS focused on overcoming some design shortcomings of the currently available host based IDS and network based IDS. All the detection nodes cooperated with each other to detect and prevent intrusions. The system referred the popular Common Intrusion Detection Framework （CIDF）. And the combination of network protocol analysis with pattern match technology was adopted in designing the detection methods. Furthermore, the system＇s architecture, each component＇s function, and some key techniques of this system were introduced.

关 键 词：入侵检测系统 分层协作 分布式 

分 类 号：TP309.08[自动化与计算机技术—计算机系统结构]