一种基于代理的DIDS的构建方法

一个入侵检测系统应具有准确性、可靠性、可用性、适应性、实时性和安全性等特点。通过分析目前入侵检测系统存在的不足,提出了一个基于移动代理的分布式检测系统的模型。目前的入侵检测系统一般采用集中式的系统结构,存在单点失效、效率低等问题。使用代理技术,不但解决了传统入侵检测体系结构的瓶颈问题,同时可以对入侵行为进行追踪,收集与入侵相关的信息,决策入侵是否发生。同时还详细介绍了基于代理的DIDS的模型的体系结构、各部分的功能、系统的工作流程等。

Architecture for Distributed Intrusion Detection System Based on Agents

An IDS must have some features such as veracity, dependability, usability, adaptability, real-time quality and security. The shortage of current intrusion detection system is analyzed and a distributed intrusion detection system model based on mobile-agents is presented. At present, most of the IDS adopt centralizing structure, which leads to single fault, low efficiency. The agent-technology can resolve the bottleneck problem of the traditional IDS, track intrusion, collect information, and judge whether the intrusion happened. The system structure, function of all parts and work-flow of the DIDS were also introduced.