基于可信对等的分布式入侵检测通信框架设计  

Implement of trusted and peer to peer communication framework in distributed intrusion detection

作　　者：金丽[1] 朱浩[2,3] 

机构地区：[1]南通大学江苏省专用集成电路设计重点实验室,江苏南通226019 [2]南通大学计算机科学与技术学院网络教研室,江苏南通226019 [3]南京航空航天大学信息科学与技术学院,江苏南京210016

出　　处：《计算机工程与设计》2010年第5期969-972,共4页Computer Engineering and Design

基　　金：南通大学自然科学基金项目(08Z067)

摘　　要：为了提高分布式入侵检测的实时性和安全性,提出了一种可信对等的分布式入侵检测通信框架的模型。该模型借鉴了P2P和代理技术,不同网络节点中的入侵检测代理是对等的,它们之间通过共享检测信息进行整体协防。该模型还借鉴了安全通信技术,在网络中建立了一个认证服务器,不在同一网络节点的任何两个网络进程的通信必须通过该认证服务器,提高了入侵检测自身的安全性。设计实现了一个原型系统,原型系统的实验结果表明了该模型的正确性和可行性。To improve performance ofreal time and security, a model oftrusted and peer to peer communication framework in distributed intrusion detection is put forward. Using the technology of peer to peer and agent for reference, intrusion detection agents among different network nodes are peer to peer, and they collaborate to prevent intrusion through sharing the information of detection. A authentication server is established in the network by using the technology of secure communication for reference, and every two processes＇ communication in different network nodes must travel via the authentication server, such that improve the security of intrusion detection itself. A prototype is designed and implemented, and the result of the prototype＇ s test shows the correctness and feasibility of this model.

关 键 词：分布式 入侵检测 代理 对等 多播 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]