【摘要】 根据分布式入侵检测系统的设计策略,设计了一个分层协作的多代理入侵检测系统。引入分层协作机制的目的是为了克服单一的主机入侵检测系统以及网络入侵检测系统的某些缺陷。通过各个节点之间的协同工作,共同检测和防范对系统的入侵行为。系统框架参考目前流行的通用入侵检测框架CIDF构建。检测方法采用协议分析融合模式匹配的方式。介绍了系统的体系结构,各部分的功能以及系统实现的一些关键技术。更多还原

【Abstract】 According to the design tactics of distributed intrusion detection system, a Layered Cooperation Intrusion Detection System (IDS) based on the multi-agent technology was designed. The main aim in layered cooperating IDS focused on overcoming some design shortcomings of the currently available host based IDS and network based IDS. All the detection nodes cooperated with each other to detect and prevent intrusions. The system referred the popular Common Intrusion Detection Framework (CIDF). And the combination of network protocol analysis with pattern match technology was adopted in designing the detection methods. Furthermore, the system’s architecture, each component’s function, and some key techniques of this system were introduced.更多还原