一种基于多Agent的分布式入侵检测系统设计  

An Distributed Intrusion Detection System Model Based on Multi-agent

作　　者：马常楼[1] 刘永庆[1] 

机构地区：[1]海军计算技术研究所,北京100841

出　　处：《计算机与数字工程》2009年第6期102-106,共5页Computer & Digital Engineering

摘　　要：在分析现有基于Agent的入侵检测系统的基础上,提出了一种基于多Agent分布式入侵检测系统模型。该模型采用了分布检测、分布响应的模式,各Agent之间具有良好的相对独立性。通过多Agent技术的思想建立系统总体结构,给出了模型的各个组成部分,并对结构中各种Agent与中心控制台的功能设计进行了分析。同时对涉及到特征匹配算法、动态选举算法、协同算法进行了初步的设计与分析。系统可充分利用各Agent的协同完成入侵检测任务,实时响应,可有效地改进传统IDS。An intrusion detection system （IDS） aims to increase the security of a computer system by dynamically monitoring various features and parameters of the system so as to be able to detect intrusions at the earliest possible. In this paper, a distributed IDS （DIDS） model based on multi-agent is proposed by analyzing the existed agent-based IDS, which adopts the method of distributed detection, distributed response and the ideology of multi-agent. And it describes all the composed parts of DIDS model and analyzes the function design of all kinds of agent and the control centre. To im- prove the performance of the control centre, an algorithm for reasoning must be presented to solve the problem of judge the uncertain access. Furthermore, the algorithms of feature matching, dynamic election and cooperation are discussed preliminarily. The proposed DIDS may make full of all kinds of information to cooperatively complete the detection and make real-time response, which effectively improves the traditional DIDS.

关 键 词：分布式入侵检测系统 多AGENT 特征匹配 协同 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]