一种新的基于相关性的层次型分布式入侵检测模型  

A Novel Hierarchical Model of Distributed Intrusion Detection System Based on Correlation

作　　者：危辉平[1] 陶宏才[1] 

机构地区：[1]西南交通大学信息科学与技术学院,四川成都610031

出　　处：《成都信息工程学院学报》2012年第1期38-42,共5页Journal of Chengdu University of Information Technology

摘　　要：针对传统的分布式入侵检测模型的局限性,提出了一种新的基于相关性的层次型分布式入侵检测模型,有效地解决分布式模型中通信代价和检测准确性的矛盾。核心思想是:检测代理间的协作程度应该和其相关性成正比。通过量化检测代理间的相关性,将整个分布式系统分割成多个高度相关的子系统,而子系统间通过动态代言人机制进行协作,有效地减少分布式系统中低价值的通信。最后从理论上证明了有效性和高效性。As there is some limit in the traditional distributed intrusion detection model,a novel hierarchical model of distributed intrusion detection system based on correlation is proposed.It can effectively solve the conflict between communication cost and detection accuracy in distributed system.The core idea of the new model is that collaboration level of two correlation entities depend on their correlation.The highly relevant collaborative intrusion detection subsystem is built by quantifying the entities＇ correlations,and separating the whole distributed model into multiple highly correlate subsystems with dynamic agents to coordinate themselves,which could effectively decrease the system＇s useless communications.The effectiveness and efficiency of the new method is proved in theory.

关 键 词：计算机应用技术 网络安全 分布式入侵检测 相关性 层次型 检测模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]