基于P2P的入侵警报发布/订阅系统  

A P2P-Based Subscribe/Publish System for Intrusion Alert

作　　者：陈勤[1] 林朝炽[1] 徐明[1] 

机构地区：[1]杭州电子科技大学计算机学院,浙江杭州310018

出　　处：《计算机工程与科学》2009年第12期5-8,共4页Computer Engineering & Science

基　　金：浙江省自然科学基金资助项目(Y106176)

摘　　要：针对集中式发布/订阅系统不可扩展性的问题,本文提出一种构建于结构化P2P网络的入侵警报发布/订阅系统,节点之间通过发布/订阅机制分享入侵情报信息,以形成对于当前网络威胁的全局观点;提出了一种多属性的警报关联方案,从初级入侵警报中提取重要的入侵模式;在Pastry上实现了一个原型系统,通过Witty蠕虫数据集对系统进行仿真评估。实验结果表明,该方案具有良好的负载均衡特性。For the poor scalability of the centralized architecture, we propose an intrusion alert subscribe/publish system over the structured P2P network, which enables all the participating intrusion detection systems to share suspicious intelligence with each other to form a global view of the current security threats. An alert-correlation scheme based on multiple features is proposed to extract the significant intrusion patterns from raw intrusion alerts. We implement a prototype based on Pastry, and evaluate it with Witty Worm datasets. The experimental results show good load balancing of the scheme.

关 键 词：P2P 发布/订阅 入侵检测系统 负载均衡 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]