一种适合分级Ad Hoc网络的入侵检测机制  

A Feasible Intrusion Detection Mechanism in Hierarchical Ad Hoc Networks

作　　者：于尧[1] 郭磊[1] 王兴伟[1] 

机构地区：[1]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《东北大学学报（自然科学版）》2010年第9期1246-1249,共4页Journal of Northeastern University(Natural Science)

基　　金：国家自然科学基金资助项目(60802023;70931001);国家高技术研究发展计划项目(2007AA041201);国家科技支撑计划项目(2008BAH37B03;2008BAH37B07);教育部高等学校博士学科点专项科研基金资助项目(20070145096;20070145017);教育部新世纪优秀人才支持计划项目(NCET-08-0095);霍英东教育基金会青年教师基金资助项目(121065);中央高校基本科研业务费专项资金资助项目(N090504001;N090504003)

摘　　要：针对分级Ad Hoc网络的结构特点和安全需求,提出一种基于节点行为的移动Agent入侵检测安全机制.该机制通过分析节点在路由过程中处理报文的能力建立标准节点行为模型,利用簇首Agent监测、收集簇中成员的行为信息,并与标准行为模型进行信息匹配分析,判断节点的异常行为,借助模糊方法定位攻击节点,采取相应的响应措施遏制恶意节点对网络的危害.仿真结果表明,所提出的安全机制能够快速、准确地检测到网络中的异常情况.An intrusion detection mechanism was proposed for mobile agent to meet the security requirements in accordance to the hierarchical characteristics of Ad Hoc networks.In this mechanism,a typical behavior model of nodes is developed by analyzing the node＇s ability to deal with the messages in routing process.The cluster-head agent is used to monitor and collect the behavior information of all the members in the cluster.Then,the collected information is matched with the typical behavior model to estimate the abnormal behavior of the node,thus locating the attacking node by virtue of fuzzy method so as to take responding measures to restrict the harm of malicious nodes which are attacking the network.Simulation results showed that the intrusion detection mechanism proposed can detect the abnormalities in time and accurately in hierarchical Ad Hoc networks.

关 键 词：分级Ad HOC网络 入侵检测 行为分析 移动AGENT 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]