基于模糊行为分析的移动自组网入侵检测  

Intrusion Detection for Ad Hoc Routing Based on Fuzzy Behavior Analysis

作　　者：张晓宁[1] 冯登国[1] 

机构地区：[1]中国科学院软件研究所信息安全国家重点实验室,北京100080

出　　处：《计算机研究与发展》2006年第4期621-626,共6页Journal of Computer Research and Development

基　　金：国家自然科学基金项目(60273027);国家"八六三"高技术研究发展计划基金项目(2003AA142150)

摘　　要：移动自组网络是一种不需要基础设施的网络.在这种网络中,移动节点是自组织的,并且需要互相提供网络路由服务.自组网络非常容易受到攻击,特别是内部攻击.提出了一个基于模糊行为分析的入侵检测方案,以检测网络内部的路由攻击.利用邻接节点监测,通过分析节点路由行为与路由规范的偏差,发现恶意行为.在数据分析的过程中引入了模糊路由行为分析的方法,大大降低了误报率.仿真实验表明,该方案能有效地检测出路由入侵行为,而将误报率控制在一个较低的水平.Mobile ad hoc network is a kind of network that does not need infrastructure. In such networks mobile nodes are self-organized and provide network routing for each other. Ad hoc networks are extremely vulnerable to attacks, especially internal attacks. In this paper, an intrusion detection scheme is proposed to detect internal routing attacks. In the scheme, every node monitors its adiacent nodes and tries to detect their misbehavior by analyzing the difference between their route behavior and the route specification. An FBA （fuzzy behavior analysis）method is introduced into the data analysis procedure, which can greatly decrease the false alarm rate. Simulation result shows that the scheme can effectively detect intrusions, while keeping the false alarm rate comparatively low.

关 键 词：移动自组网 动态源路由 入侵检测 模糊行为分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]