摘要
研究了分布式入侵检测系统的体系结构,提出了一种基于Aglets的入侵检测模型。用改进的Snort作为节点的检测引擎,将规则库按攻击类别分类,然后根据最优搜索原理,将有限的时间分配到每类攻击的检测中去,在尽量不丢包的情况下使检测到攻击的概率最大化。使用移动代理监视各节点的可疑信息和报警信息,并使用移动代理对这些信息进行融合分析,从而提高检测的精度。这种结构,不但能检测到传统的攻击行为,而且能检测到分布式攻击,可以减少网络流量,提高系统的实时性。
The architecture of the distributed intrusion detection system is studied. The paper provides a model of DIDS based on Aglets. It uses the improved Snort as the detection engine in a node. It divides the rules database into several cells according to the attack type, then allocates the limited time on cells, and maximizes the probability in detecting attacks. Mobile agent is used to monitor the suspicious or alarm information in a node, to fuse and analyze events, thus improves the accuracy of detection. This architecture can detect not only the conventional attacks, but also the distributed attacks. To use mobile agents can also reduces Network traffic, improves real-time performance, and easily manage.
出处
《微计算机信息》
2009年第24期57-58,70,共3页
Control & Automation
