【作者】 黄鹏；

【导师】 张秋余；

【作者基本信息】 兰州理工大学 ， 计算机软件与理论， 2007， 硕士

【摘要】 目前，网络面临的安全威胁主要来自于黑客通过网络对计算机系统的入侵。相对于传统的破坏手段而言，网络入侵没有地域和时间的限制，入侵手段更加隐蔽和复杂。如何对入侵进行检测，已成为众多网络安全手段所关注的重要问题之一。基于免疫学的入侵检测是近几年来入侵检测领域研究的热点，它的突出特点是利用生物体免疫系统的原理、规则与机制来实现对入侵行为的检测与反应。在分析现有IDS(Intrusion Detection System)实现技术的基础之上，本文给出了一种分布式入侵检测系统AIIDS(Artificial Immune Intrusion Detection System)的设计思想和总体架构。AIIDS利用了人工免疫学的原理，采用多代理的分布式体系结构，克服了现有入侵检测系统在可移植性、可扩展性等方面存在的不足。对人工免疫学原理的利用是实现AIIDS的重要内容之一。通过对人工免疫学基本概念的分析研究，将多种人工免疫原理渗透到AIIDS的设计和开发中。特别是针对现有的基于人工免疫原理的应用系统只是单一地采用人工免疫算法的问题，将人工免疫的思想融入到系统的架构中去，提出了入侵检测系统的三种运行模式，让各个模式有效地对免疫系统进行仿真。同时，为了加强系统的可扩展性和可移植性，AIIDS利用多代理系统进行实现，采用Java作为开发工具，整个系统在JADE(Java Agent Development Environment)平台上进行开发。本文除了对JADE进行深入分析之外，还通过Perti网和MVC(Model-View-Control)设计模式的引入解决了JADE对并发消息以及图形界面支持不足的问题。最后，在所讨论的人工免疫原理以及多代理系统的基础上，论文深入研究了AIIDS的架构，对架构的各个部分的功能、要求进行了分析，通过实验来对参数进行选择，指出了设计和实现过程中的重点、难点，并利用Lincoln实验室入侵检测数据集对AIIDS进行了测试。测试结果表明，AIIDS可以较好地检测出网络中存在的入侵行为，系统操作简单且易于扩展，达到了预期目标。更多还原

【Abstract】 Breaking into computer systems through the network has become the main threaten to the network security. Compared to traditional intrusion methods, network intrusion eliminates the limits of time and location, and has lots of intrusion ways that are difficult to detect. How to detect the intrusions has become a key issue of the network security field. In recent years, immune-based intrusion detection has become a key research area in intrusion detection system, exploring natural immunological theories, mechanisms and principles for detecting and reacting to intrusions.Based on the analyzing of current implement ways of IDS (Intrusion Detection System), the design consideration and the architecture of a distributed intrusion detection system, AIIDS (Artificial Immune Intrusion Detection System), is presented. In order to overcome the defects of general IDSs, such as lack of extensibility and transplantability, AIIDS employs artificial immune theory and adopts agent-based architecture.To use the artificial immune theory is an important issue during the implement of AIIDS. By analyzing of the essential conception of artificial immunology, many artificial immune principles are adopted during the design and development of AIIDS. Especially, the artificial immune theory is not only employed as an algorithm just like in the existing artificial-immune-based systems, but also combined with the system architecture. To make the AIIDS run as a real immune system effectively, three types of running mode of the IDS are proposed.Furthermore, to improve the expansibility and transplantability of the system, AIIDS is implemented as a JADE based multi-agent system and employs Java to develop. Except the embed analyses of JADE, Petri net and MVC (Model-View-Control) design mode are adopted to solve the problems in JADE such as the lack supports to the concurrent messages and the graphical interface.Finally, Based on the artificial immune theory and the characteristic of multi-agent system, the architecture of AIIDS is investigated deeply. The function and demand of the different part of architecture is analyzed. Through the experiments, the proper parameters are selected and the key point during the design and implement is pointed out. By using the intrusion detection data set from Lincoln laboratory to test, the result disclaim that AIIDS can detect the network attacks effectively, easy to manipulate and expand without difficulty. The expected goals are achieved.更多还原