一种基于对等模型的网络入侵检测系统模型  

A Distributed Intrusion Detection System Based on Peer-to-Peer Model

作　　者：李兵 

机构地区：[1]中铁建电气化局集团第四工程有限公司,湖南长沙410001

出　　处：《计算机技术与发展》2008年第3期173-176,共4页Computer Technology and Development

基　　金：国家自然科学基金资助(60673165);湖南省自然科学基金资助(05JJ30119);湖南省科技计划项目(2006JT1040)

摘　　要：基于对等模型(Peer-to-Peer)的应用,提出一种分布式网络入侵检测系统:PeerIDS。该系统在设计上注重可靠性,且没有诸如单点失效一类的问题。入侵检测工作在由多台运行PeerIDS系统的连网计算机构成的对等网中随具体环境而自动进行迁移,以实现公平高效的分布式处理。同时,应用对等模型带来的可扩展性,使得该系统的性能可以通过简单地在网络中增加运行PeerIDS的计算机数目来不断提高,很好地适应了日益严峻的网络安全状况。在完成初始设置后,PeerIDS系统的运行几乎不需要任何使用者的干预,体现了很好的自治性。By enaploying the peer- to- peer（P2P）rnodel,whieh is considered a promising approach to solve many problems in a distributed environment, presented a distributed network intrusion detection system named PeerlDS：an IDS solution values the properties of feasibility,durability and scalability most. Viewing the problam from a different pempective as against its counterparts,PeerlDS will provide the networked computation environment with robust and scalable protection while still stays efficient with the bumting of both types and traffic of malicious attacks through automatically and evenly distribute the intrusion detection workload anaong all the cooperating PeerlDS instances. Compared with many other distributed intrusion detection approaches,no single point of failure can be found in afoma of synergized PeerIDS instances. Moreover, PeerIDS entails almost no additional administration work after the installation and first time setup.

关 键 词：对等模型 网络入侵检测 分布式 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]