基于多代理的协同分布式入侵检测系统模型  

Cooperative distributed intrusion detection system based on multi-agent

作　　者：陈晓苏[1] 林军[1] 肖道举[1] 

机构地区：[1]华中科技大学计算机科学与技术学院

出　　处：《华中科技大学学报（自然科学版）》2002年第2期92-95,104,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

摘　　要：给出了一种基于多代理的协同分布式入侵检测系统模型 (CDIDS) .该模型依靠基于主机的代理HIDA和基于网络的代理NIDA ,运用异常检测与特征检测相结合的方式进行有效的入侵检测 ;在分布式的网络环境下 ,系统通过入侵检测控制中心实现检测 /响应模块的协同工作 ,为单个主机的攻击与大规模的网络入侵提供应对策略 。This paper proposes a type of Cooperative Distributed Intrusion Detection System (CDIDS) based on multi agent. The effective detection can be performed by host based agents and network based agents using the mixed mode of behavior based anomaly detection and knowledge based signature detection in this mode. The detection agents and response agents can be cooperate under the control of Intrusion Detection Control Center (IDCC) in the distributed environment of network. That can take counter measures against both the attack on single host and the large scaled intrusion and use QoS to distribute data stream to NIDAs for improving the performance.

关 键 词：分布式结构 入侵检测系统 代理 协同工作 网络安全 入侵响应 检测机制 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]