Multi-ISM联盟的网络安全系统协作模型及算法  

Cooperation model and algorithm for network security system based on multi-ISM alliance

作　　者：马占飞[1] 杨树英 

机构地区：[1]内蒙古科技大学包头师范学院,内蒙古包头014030 [2]包头服务管理职业学校网络技术系,内蒙古包头014030

出　　处：《华中科技大学学报（自然科学版）》2015年第5期50-55,共6页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61163025);内蒙古自治区自然科学基金资助项目(2010BS0904);内蒙古自治区高等学校科学研究基金重点资助项目(NJ10162);包头市科学研究基金资助项目(2014S2004-3-1-26)

摘　　要：针对现有网络入侵检测系统(NIDS)存在智能程度低、自适应能力弱、协同性差、负载不均衡等局限性,引入了免疫软件人(ISM)智能体的理论,提出了一种基于multi-ISM联盟的网络入侵检测与防御系统的分布式社区协作控制模型及其算法.该模型系统采用了部分-全局规划(PGP)策略以及multi-ISM间的协作、协调和协商机制,融合了网络协作模型与层次模型的优点,从性能上改善了当前分布式入侵检测系统(DIDS)难以适应高带宽、大流量的动态网络环境等问题.实验结果表明:该模型系统相比其他的DIDS,在检测性能和误报率等方面具有明显优势,对于服务器系统资源的占用率不是很大,同时它还能够较好地解决网络信任社区内与社区间的协同防御和预警问题.Existing network intrusion detection system（NIDS）has many disadvantages,such as lower intelligent,poor adaptive capacity,weak coordination and load balancing.Inspired by the intelligence recognition capability of immune-SoftMan（ISM）,a novel distributed community cooperation model and corresponding algorithm were thus proposed.The system model was based on multi-ISM alliance for the network intrusion detection and defense system（MISMNIDDS）.The partial-global planning（PGP）strategy was adopted by MISMNIDDS.Moreover,the cooperation,negotiation and coordination mechanism of autonomy ISM′s were possessed.The system model combined the merits of the level model and collaboration model,and could be self-updated locally to adapt to dynamic network environment.The results show that the MISMNIDDS is a self-organizing network security system.Compared with traditional DIDS,the MISMNIDDS possesses higher detection performance,lower false alarm rate and fewer server system resources.Furthermore,the MISMNIDDS enables member sites in the same trust community or different ones to resist attacks cooperatively.

关 键 词：网络安全 入侵检测 人工智能 免疫软件人 网络结构 协作控制 分布式 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]