【作者】 熊小萍；

【导师】 梁京章；

【作者基本信息】 广西大学 ， 控制理论与控制工程， 2005， 硕士

【摘要】 随着黑客入侵事件的日益猖獗,人们发现只从防御的角度构造安全系统是不够的。入侵检测技术是继“防火墙”、“数据加密”等传统安全保护措施后新一代的安全保障技术。它对计算机和网络资源上的恶意使用行为进行识别和响应,它不仅检测来自外部的入侵行为,同时也监督内部用户的未授权活动。 在本文中首先介绍了入侵检测系统与移动代理方面的相关特性,在分析已有入侵检测模型的基础上,设计了一个基于移动代理的入侵检测系统模型框架。该模型选用IBM开发的Aglet移动代理平台,具有良好的可移动性和可扩展性。在网络引擎的实现上,使用协议分析和模式匹配相结合的方法,有效减小目标的匹配范围,提高了检测速度。 本文主要从以下两个方面对基于移动代理的入侵检测系统进行探讨:第一是针对其可移动性问题,在网络引擎,代理,代理平台以及安全性处理上均采用java语言进行编写实现。第二是针对其代理自身的安全性问题,代理平台对代理进行统一管理,各个代理具有一定的自治性,可单独使用。对代理平台和代理分别进行身份认证,并利用政策文件对代理进行授权。更多还原

【Abstract】 With more and more site intruded by hackers, security expert found than only use crypt technology to build a security system is not enough. The Intrusion Detection is a new security technology, apart from tradition security protect technology, such as firewall and data crypt. They watch the computer and network traffic for intrusive and suspicious activities. They not only detect the intrusion from the Extranet hacker, but also the intranet users.After introducing the characteristics of IDS and mobile agent, and analyzing the intrusion detection model, the thesis has designed an intrusion detection system model framework based on mobile agent. The model has good mobility and extensibility because of using the Aglet platform. And the network engine has used the method of protocol analysis and pattern matching, reducing the matching range effectively and raising the speed of detection.In the thesis, two following aspects have been discussed about IDS: firstly, aiming at it’s mobility, the network engine, agent, agent platform and security treatment have adopt java language to realize. Secondly, aiming at agents’ self-security, the autonomy agents having been unified managed can use individually. The thesis not only authenticates the platform and agent but also utilizes the policy file to authorize the agents.更多还原