一种基于多移动agent的分布式恶意进程协同识别机制  

Distributed collaborative malicious process identification mechanism based on multi-mobile-agent

作　　者：徐小龙[1,2] 唐瑀[1] 杨庚[3] 

机构地区：[1]南京邮电大学计算机学院,南京210003 [2]计算机软件新技术国家重点实验室(南京大学),南京210046 [3]宽带无线通信与传感网技术教育部重点实验室,南京210003

出　　处：《计算机应用研究》2013年第10期3101-3105,共5页Application Research of Computers

基　　金：国家自然科学基金资助项目(61202004;61272084;61202353);国家"973"计划资助项目(2011CB302903);江苏省自然科学基金资助项目(BK2011754;BK2009426);中国博士后科学基金资助项目(2012T50514;2011M500095);江苏省博士后科研计划资助项目(1102103C);江苏省高校自然科学研究计划资助项目(12KJB520007);江苏省高校自然科学研究计划重大项目(11KJA520002);江苏省科技支撑计划资助项目(BE2009158);南京大学计算机软件新技术国家重点实验室资助项目(KFKT2012B21)

摘　　要：为了提高整个网络系统的安全防御能力,提出了一种新的基于多移动agent的分布式恶意进程协同识别机制,使网络中的服务器和多个终端节点有机地协同工作,终端主动地向服务器提交发现的可疑进程报告,由专家来统一鉴别,服务器也主动地收集用户节点的信息和更新用户终端的进程信息库,从而将传统单机防御提升到网络级的协同防御。为了进一步提高系统性能,机制引入了多移动agent来实现节点的状态监控、协同工作和信息主动收集与更新,并优化了移动agent在网络中的迁移路由。原型系统及性能分析表明,基于多移动agent的分布式恶意进程协同识别机制具有负载均衡、兼容性好、反应快捷、灵活可靠等性能表现。In order to improve the whole network system security capability, this paper proposed a new distributed collaborative malicious process identification mechanism based on multi-mobile-agent. The mechanism made the network servers and termi- nals collaborate organically. Terminals submitted the reports of suspicious process to servers initiatively, which would be sent to the experts to identify. The servers could also collect terminals＇ information and update the process information bases on the user terminals to meet the software updating status initiatively. The method enhanced the traditional stand-alone defense into the network collaborative defense level. In order to avoid the system bottleneck and improve the system performance, the mecha- nism adopted the multi-mobile-agent to achieve node status monitoring, collaboration and information collection and updating, and it also optimized the route of mobile agent. The prototype system and the performance analysis shows the mechanism has ~ood performance, such as load balancing, good compatibility, rapid resDondinz, flexibility and reliability.

关 键 词：协同 恶意代码 进程 信息安全 多移动AGENT 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]