一种基于代理和蜜罐技术的分布式入侵检测系统模型  

An Autonomous Distributed Intrusion Detection System Based on Agent and Honeypot

作　　者：库宇[1] 胡亮[1] 张晓晖 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012 [2]长春市公安消防支队,长春130062

出　　处：《吉林大学学报（理学版）》2007年第3期399-404,共6页Journal of Jilin University:Science Edition

基　　金：国家自然科学基金(批准号:60473099);教育部新世纪优秀人才支持计划项目基金(批准号:NCET-06-0300).

摘　　要：提出一种基于Agent的自适应分布式入侵检测系统模型,以解决大多数传统的、采用集中式的分析引擎的入侵检测系统误报率较高且缺乏自适应性的缺点;同时,针对现有大多数模型具有较高漏报率的问题,提出一种基于蜜罐分布式的入侵检测系统模型.Most traditional intrusion detection systems adopt the analysis engine of the concentrating type, so it is already difficult for them to meet the extensive security demand of the distributed network environment. An autonomous-agent-based adaptive distributed intrusion detection system was proposed to solve these problems. A honeypot-based distributed intrusion detection system was proposed to solve the higher rate of false negatives in most models. Moreover a detail description was given to the architecture and work mechanism of the model, and the character of the model was analyzed.

关 键 词：网络安全 入侵检测 代理 蜜罐 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]