基于代理的分布式入侵检测系统研究与设计

传统的入侵检测系统一般局限于单一的主机或网络架构,对异构系统及大规模网络的检测明显不足,同时不同的入侵检测系统之间不能协同工作.分布式入侵检测将会是未来的主流.本文提出了一种基于AGENT的检测系统作为在网络环境中的IDS,AGENT的灵活性保证它可以成为保障系统的安全提供混合模式的架构,重点讨论了自适应模型生成、系统的总体结构、关键部件设计、Agent管理及系统实现等问题.

Study and Design of an Agent-based Distributed Intrusion Detection Systems

Traditional IDS(Intrusion Detection Systems) are usually restricted to a single host or network,its capability to detect heterogeneous systems and large-scale networks is not sufficient,and different IDS systems can not work cooperatively.Distributed Intrusion Detection Systems(DIDS) are becoming the mainstream systems in the future.This paper presents an agent based intrusion detection system oriented to network environments.The flexibility of Agent ensures that the system becomes a mixed architecture to the security protection.This paper focuses on issues of self-adaptive model,system architecture,key components and agent managements.