基于移动代理和动态拓扑结构的入侵检测系统模型

分布式网络攻击的破坏性越来越大。网络在运行中拓扑结构又是在动态变化的。如何在拓扑结构变化的网络中去发现和阻止网络攻击，本文提出了一个基于移动代理技术的模型。模型由拓扑发现代理、拓扑计算代理、检测代理、追踪代理、阻击代理组成。拓扑发现代理和拓扑计算代理完成网络拓扑结构跟踪，检测代理、追踪代理、阻击代理完成对分布式网络攻击的探测、追踪、阻止。该模型具有适合大规模网络、占用网络带宽少、能自动跟踪网络拓扑变化、系统的入侵检测和响应与拓扑变化无关等特点。

Intrusion Detection System Model Based on Mobile Agent and Dynamic Topology

Destroying computer network of distributed attack becoming severer and severer.Topology is dynamic dur- ing operation of computer network.How to discover and hold back attacks in this case? A model based on mobile agent technology is presented in this paper.The model is consisted of topology discovering agents,topology computing a- gents,attack detecting agents,attack tracing agents,and attack stopping agents.Topology is generated from topology discovering agents and topology computing agents.Detecting,tracing and stopping attacks is respectively done by at- tack detecting agents,attack tracing agents,and attack stopping agents.The system based on the model can adapt to large-scale network,generates less traffic,automatically trace change of topology.It can detect and response to attacks independent of changing of topology.