一种分布式协同入侵检测系统的设计与实现  

Design and Implementation of a Distributed Cooperative Intrusion Detection System

作　　者：段海新[1] 吴建平[1] 

机构地区：[1]清华大学信息网络工程研究中心,北京100084

出　　处：《软件学报》2001年第9期1375-1379,共5页Journal of Software

基　　金：国家 8 6 3高科技发展计划资助项目 (86 3- 30 6 - ZD0 8- 0 1- 3)~~

摘　　要：提出了一种能够精确描述入侵检测技术的综合分类方法 ,针对多管理域环境设计了一个分布式协同入侵检测系统 (distributed cooperative intrusion detection system,简称 DCIDS) ,通过不同管理域 IDS(intrusion detec-tion system)之间高效安全的通信 ,实现协同检测 .介绍了 DCIDS的系统结构和 4个组成部分 :传感器、分析器、管理器以及用户界面 ,并讨论了系统实现中的安全通信。An integrative taxonomy for intrusion detection technologies is proposed, which can specify accurately existing intrusion detection methods. Aiming at multiple-domain environments, a distributed cooperative intrusion detection system (DCIDS) is designed, which implements cooperative intrusion detection through efficient, secure information exchange among IDSes in different domain. The architecture of intrusion detection systems is described, as well as its four components: sensor, analyzer, manager and user-interface. Some key issues are also discussed, including secure communication and selection of detection places.

关 键 词：网络安全 网络管理 认证 访问控制 分布式协同入侵检测系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]