基于免疫Agent的网络入侵检测系统  

Intrusion Detection System Based on Immune Agent

作　　者：李永忠[1] 徐静[1] 罗军生[1] 孙彦[1] 

机构地区：[1]江苏科技大学电子信息学院,镇江212003

出　　处：《计算机科学》2008年第12期122-125,共4页Computer Science

基　　金：江苏省教育厅/江苏科技大学基金(2005DX006J)

摘　　要：结合计算机免疫学原理和多Agent技术构建了一个网络化、分布式、智能化的入侵检测系统,该系统融合了两者的优势,同时继承了多Agent系统和免疫系统的优点。其特点是能同时进行多层次的监测和不同级别的响应。系统是完全分布式结构,监视Agent生成后在网络上漫游,各个Agent分布在网络的各个结点上,单个结点受到攻击不会影响其他结点的检测能力,避免了单点失效问题。将疫苗概念引入系统,使得各个Agent可以实现互相学习,增强了整个网络的耐受性、"记忆"机制及新抗体生成机制的能力,提高了系统的适应性,不仅能检测到已知的攻击,而且还能检测到未知的攻击。A new intrusion detection system （IDS） based on immune agent was presented. It combines multi-agent technology with immune principles, a concept of immune agent was also presented. Compared with the traditional system, this system is flexible, distributed, intelligent and so on. In this system, scout agents, which are based on immunity, roam around the nodes, and monitor the situation in the network at different levels, including the user level, system level, process level and packet level. These scout agents can learn and adapt to the environment dynamically. This system model possesses characteristics such as distribution, robustness, intelligent nature and adaptability etc, the adaptability and other characteristics network security system are increased. This system not only detects the given intrusions, but also the unknown intrusions.

关 键 词：入侵检测系统 免疫学原理 免疫AGENT 多AGENT 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TH166[自动化与计算机技术—计算机科学与技术]