实现分布式入侵检测的关键技术研究  

Research on the Key Technique to Develop a Detection System of Distributed Intrusion

作　　者：史志才[1] 韩彦铎[2] 贾百奎[1] 沈连山[1] 

机构地区：[1]大连大学信息工程学院,辽宁大连116622 [2]大连大学人事处,辽宁大连116622

出　　处：《大连大学学报》2007年第3期14-18,共5页Journal of Dalian University

基　　金：辽宁省教育厅高等学校科学技术研究项目(20040046)

摘　　要：入侵检测系统作为防火墙的重要补充在网络安全运行过程中起到相当重要的作用.随着网络攻击的日益复杂化,引入了代理(Agent)机制以方便分布式入侵检测系统的开发和增强检测系统的性能.本文首先对入侵检测技术进行了分类和分析,剖析了Agent技术对分布式入侵检测技术的影响,就分布式入侵检测系统实现过程中的关键技术进行了讨论,并给出了详尽的解决方案.The intrusion detection technique is used to compensate the drawbacks of firewall and it plays an important role in the procedure of network running. As attacks on the network are becoming more comphcated, the agent technique is introduced to develop a detection system of distributed intrusion, and its performance is enhanced. The technique of intrusion detection is analyzed and classified in this paper. The affection of agent technique for the detection system of distributed intrusion is described. Some key techniques to be used to develop the detection system of distributed intrusion are proposed and discussed. The methods to solve these key techniques are illustrated in detail.

关 键 词：网络安全 入侵检测 代理 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]