基于智能Agent和数据挖掘技术的蜜罐系统的研究

传统的网络安全技术被动防护的特点,很难满足现在网络的需要。文章利用Agent的智能化和分布式协同处理功能,在传统蜜罐的基础上,提出一种基于智能Agent的蜜罐系统结构,并对获取的非法数据进行关联、挖掘,根据已有的入侵方法找出未来可能发生的入侵方式。系统利用智能Agent的分布式处理能力特点完成对各个服务器和主机的保护;利用数据挖掘算法在大量数据中提出有用信息不断更新知识库;利用专家系统实现对非法访问到蜜罐系统的漂移;利用蜜罐系统作为非法数据容器和分析工厂。文章首先介绍传统网络安全技术的不足;然后针对智能Agent、蜜罐技术的研究现状进行阐述;接着提出基于Agent和数据挖掘技术的蜜罐系统的模型;最后指出其发展前景和面临的挑战。

Research on Intelligent Agent and Data-mining Technology-based Honeypot System

Point to passiveness of traditional network security technologies,this paper presents a distributed active defense system for network,based on intelligent agents and honeypot technology.This work maked use of Distributed coordination processing and intelligence of intelligent Agent to increase coordination ability,and utilize honeypot technology to collect enough intrusion data for analysis.Data mining was used in analysis agent module.And protection of servers and inside network segment can be implemented by intelligent agent which use expert system to drift the illegal intrusion to honeypot.