基于时间自动机的Ad hoc网络入侵检测  

Intrusion Detection Based Timed Automata for Ad hoc Networks

作　　者：易平[1,2] 柳宁[1] 吴越[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200030 [2]东南大学儿童发展与学习科学教育部重点实验室,南京210096

出　　处：《电子与信息学报》2009年第10期2310-2315,共6页Journal of Electronics & Information Technology

基　　金：国家863计划项目(2006AA01Z436;2007AA01Z452;2009AA01Z118);上海市自然科学基金(09ZR1414900)资助课题

摘　　要：该文提出一种基于时间自动机分布式合作的入侵检测算法。首先,将整个网络分为子区域,每一区域随机选出簇头担任监视节点,负责本区域的入侵检测。其次,按照路由协议构筑节点正常行为和入侵行为的时间自动机,监视节点收集其邻居节点的行为信息,利用时间自动机分析节点的行为,识别入侵者。该算法不需要事先进行数据训练并能够实时检测入侵行为。最后,通过模拟实验证实了算法的有效性。In this paper, a distributed intrusion detection approach is proposed based on timed automata. A cluster-based detection scheme is presented, where periodically a node is elected as the monitor node for a cluster. These monitor nodes can not only make local intrusion detection decisions, but also cooperatively take part in global intrusion detection. And then the timed automata is constructed by the way of ma^mally abstracting the correct behaviours of the node according to the routing protocol of Dynamic Source Routing （DSR）. The monitor nodes can verify every node＇s behaviour by timed automata, and validly detect real-time attacks without signatures of intrusion or trained data. Compared with the architecture where each node is its own IDS agent, our approach is much more efficient while maintaining the same level of effectiveness. Finally, the intrusion detection method is evaluated through simulation experiments.

关 键 词：移动AD HOC网络 路由协议 网络安全 入侵检测 时间自动机 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]