基于免疫的移动Agent入侵检测系统模型设计

【作者】 李学宝；

【导师】 宋如顺；

【作者基本信息】 南京师范大学 ， 运筹学与控制论， 2006， 硕士

【摘要】 入侵检测系统是一种网络安全防护系统，被用来检测威胁或危害主机或计算机网络资源的完整性、机密性和可用性的企图或行为。由于其在计算机安全领域中的重要地位，近年来受到研究人员的广泛关注。目前，虽然入侵检测技术已经取得了很大的进步，但传统的入侵检测系统仍然存在一些缺陷，例如在分布式、灵活性和效率等方面都存在不尽如人意的地方，需要探索新的技术来提高入侵检测系统的整体性能。 生物免疫系统是保护生物体免受外部病原体危害的一种生理系统。它具有分布式并行处理、自组织、免疫记忆和鲁棒性等优点，这也正是入侵检测系统所需具备的一些特性。免疫系统和入侵检测系统的功能有着惊人的相似性，因此我们可以借鉴一些免疫原理来提高入侵检测系统的性能。另外，Agent技术是近来出现的一种分布式计算技术，其移动性和灵活性也极其适合开发新一代的入侵检测系统。 本文对入侵检测系统原理、技术和结构进行了深入分析。在此基础上，结合生物免疫原理和移动Agent技术，提出了一个基于免疫的移动Agent入侵检测系统(IMAIDS)模型，并对其中几个模块进行了设计和研究；详细介绍了检测模块的构成以及工作流程，重点分析了与检测器相关的一些算法和机制。该系统以网络数据包为主要分析对象，只有在发现“可疑”情况时，才分析主机上的一些信息，以便能够确认入侵的发生。 该模型与同类模型相比最大优点是增加了提供“协同信号”的监控模块，克服了传统模型中由管理员提供“协同信号”的缺陷，同时也降低了误报；检测器生成算法也作了很大的改进，其主要特点是可以生成多样化的检测器，实现了使用较少的检测器检测多种入侵的目的，充分节省了系统资源。更多还原

【Abstract】 IDS(Intrusion Detection System) is a security protection system which detects the attempts or the behaviors that threaten or harm the integrality, confidentiality or usability of host or network resources.IDS has gained great attention because of its importance in computer security. Intrusion detection techniques have been improved a lot these years. However, there are still some limitations in traditional intrusion detection systems,such as distributivity, flexibility and efficiency.Therefore it is necessary to develop new technologies to improve the overall performance of IDS.BIS(Biological Immune System) is a physiological system which protects organism from pathogens.It has some advantages which are quite needed by IDS,such as distributed protection,self-organization,immune memory and robustness.There’re amazing similarities between IDS and IS(Immune System) .So we can make use of some immune principles to improve IDS.Furthermore,Mobile Agent is a distributed computing technology emerging recently.Its mobility and flexibility are perfectly fit for developing new generation of IDS.Based on the analysis of IDS principles,technologies and structures,we introduce a model of IMAIDS(Immune based Mobile Agent Intrusion Detection System),combining with immune principles and mobile Agent. This paper presents structure and execution flow of the detection module in detail and analyzes some mechanisms and arithmetics related to the detector. The system mainly focuses on network packets.It analyzes data of host to detect intrusions when something dubious happens.Compared with other IDS,IMAIDS significantly outperforms these models by adding Monitor module which provides "co-stimulation signal" reducing the probability of false positive.We also midified the generating arithmetic of detector to generate diversiform detectors so that we can save system resource by using less detectors to detect various intrusions.更多还原