基于Agent的分布式协作入侵检测系统  

Agent-based Distributed Cooperative Intrusion Detection System

作　　者：林昭文[1] 赵毅德[1] 马严[1] 

机构地区：[1]北京邮电大学计算机科学与技术学院,北京100876

出　　处：《计算机工程》2008年第5期150-152,共3页Computer Engineering

基　　金：国家部委基金资助项目;中国下一代互联网示范工程基金资助项目(CNGI-04-6-2T)

摘　　要：分析了当前入侵检测系统及其存在的问题,提出一个基于Agent的分布式协作检测模型(ADCM),给出其原型系统。该模型通过逻辑检测域(LDD)之间的协作通信,完成对新型分布式攻击的检测。实验证明ADCM可以有效地检测出具有一定隐蔽性的、分布式的协作攻击。Most of intrusion detection systems nowadays are not really distributed systems which cannot detect the distributed or cooperative attacks effectively. This paper proposes an Agent-based Distributed Cooperative Model（ADCM）, which implements cooperative intrusion detection through efficient, normative event messages exchange among Logic Detection Domains（LDDs）. It describes the functions of entities, defines the communication mechanisms, and designs some detection Agents which are independent separately, while they can communicate and cooperate with one another to take actions. Results show that ADCM can improve the ability of detecting stealthily and distributed cooperative attacks.

关 键 词：入侵检测 分布式攻击 代理 协作模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]