Agent技术在分布式入侵检测系统的应用研究*

剖析了现有的分布式入侵检测系统及其在网络中的优势,将代理(agent)技术应用到分布式入侵检测系统中,并在此基础上提出了一种基于agent的分布式入侵检测系统(agent-based distributed intrusion detectionsystem,ADIDS)的新模型。ADIDS采取无控制中心的多agent结构,充分利用agent本身的独立性与自主性,尽量降低各检测部件间的相关性,避免了单个中心分析器带来的单点失效问题。各个数据采集部件、检测部件都是独立的单元,不仅实现了数据收集的分布化,而且将入侵检测和实时响应分布化,提高了系统的健壮性,真正实现了分布式检测的思想。

Application of agent in distributed intrusion detection system

The inspiration was drawed from distributed intrusion detection system and agent technology,a novel agent-based distributed intrusion detection system(ADIDS) model was put forward and deeply researched to improve the detection capability of current network intrusion detection systems.In order to reduce the relevance of each detection components as far as possible,and avoid the simple point failure caused by the single central analyzer,the ADIDS model adopted the non-control center multi-agent,which used fully the independence agent.All of the ADIDS components were the independent unit,which had realized the distributing data collection and the real-time response.Thus the robustness of the entire system is enhanced,and the distributing detection is truly realized.