基于移动代理和动态拓扑结构的入侵检测系统模型  

Intrusion Detection System Model Based on Mobile Agent and Dynamic Topology

作　　者：邓一贵[1] 王康[2] 涂光友[1] 邱全杰[2] 

机构地区：[1]重庆大学计算机学院,重庆400044 [2]重庆大学网络技术与管理中心,重庆400044

出　　处：《计算机科学》2006年第9期74-75,共2页Computer Science

摘　　要：分布式网络攻击的破坏性越来越大。网络在运行中拓扑结构又是在动态变化的。如何在拓扑结构变化的网络中去发现和阻止网络攻击,本文提出了一个基于移动代理技术的模型。模型由拓扑发现代理、拓扑计算代理、检测代理、追踪代理、阻击代理组成。拓扑发现代理和拓扑计算代理完成网络拓扑结构跟踪。检测代理、追踪代理、阻击代理完成对分布式网络攻击的探测、追踪、阻止。该模型具有适合大规模网络、占用网络带宽少、能自动跟踪网络拓扑变化、系统的入侵检测和响应与拓扑变化无关等特点。Destroying computer network of distributed attack becoming severer and severer. Topology is dynamic during operation of computer network. How to discover and hold back attacks in this case？ A model based on mobile agent technology is presented in this paper. The model is consisted of topology discovering agents, topology computing a gents, attack detecting agents, attack tracing agents, and attack stopping agents. Topology is generated from topology discovering agents and topology computing agents. Detecting, tracing and stopping attacks is respectively done by attack detecting agents, attack tracing agents, and attack stopping agents. The system based on the model can adapt to large-scale network, generates less traffic, automatically trace change of topology. It can detect and response to attacks independent of changing of topology.

关 键 词：入侵检测 入侵阻击 移动代理 动态拓扑 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]