【作者】 彭志豪；

【导师】 王德强； 李冠宇；

【作者基本信息】 大连海事大学 ， 计算机软件与理论， 2007， 硕士

【摘要】 随着计算机网络技术的应用与发展，网络流量与日剧增，各种黑客技术层出不穷，攻击事件时有发生，网络安全问题日益成为人们关注的焦点。入侵检测技术是网络安全领域中的一个研究热点。作为防火墙的合理补充，入侵检测系统可提供对内部攻击、外部攻击和误操作的实时检测，并可与防火墙、系统漏洞检测、病毒防护等技术结合在起，构成较完整的安全防御体系。作为传统的静态安全防护系统(如身份认证、加密技术等)的有效补充，入侵检测系统在信息安全领域发挥越来越重要的作用。 由于传统的入侵检测系统仍存在着一些缺陷，例如在分布性、灵活性、效率等方面还不尽如人意，因此人们开始寻求新的技术，以求提高入侵检测系统的整体性能。为了解决这些问题，我们尝试了在入侵检测系统中引入移动Agent技术，力图使其在实时性、可扩展性、灵活性以及系统的容错能力等方面有较大的改善。本文中，我们提出了基于移动Agent的分布式入侵检测系统(MADIDS)。该系统采用入侵检测系统Snort与IBM的Aglet移动代理平台相结合，使系统具有较好的性能和灵活性，同时力求将基于主机与基于网络的入侵检测技术结合在一起，增强系统的检测能力。 本文首先介绍了入侵检测系统的相关概念及工作原理，接着对移动Agent技术及其在入侵检测系统中的应用进行了深入的研究，并在此基础上提出了基于移动Agent的分布式的入侵检测系统(MADIDS)的体系结构，并分析了该体系结构特点。此外，本文还采用了面向对象思想和技术对MADIDS进行了详细的分析和设计；同时针对目前入侵检测系统成为被攻击目标的现状和Agent技术给系统带来新的安全问题，又提出了相应的安全策略和安全机制。更多还原

【Abstract】 With the rapid development of computer network technique, security problem has become the main focus that people care about. As the strong supplement of Firewall, Intrusion detection systems can detect attacks from both outside and inside of networks, and they should be an important part of the perfect security architecture.The research of intrusion detection has grown considerably nowadays, and a large number of intrusion detection systems have been developed so as to satisfy different needs. However, the traditional intrusion detection systems(IDSs) have some shortcomings in certain aspects, such as flexibility, interoperability etc.Therefore,people begin to seek for new technologies to improve the performance of IDSs.In this thesis, we try to introduce Mobile Agent technique into IDSs to improve their flexibility, interoperability, extensibility as well as their real-time performance. We also presented a distributed intrusion detection system based on mobile agent-MADIDS, which combines the IDS Snort and mobile agent platform Aglet.In MADIDS,the detection tasks are implemented by two types of detection mobile agents, which enable the system have certain flexibility,interoperability and intelligence as well as good performance.Firstly, we analyze and summarize the technologies of IDS and mobile agent.Then we put an emphasis on mobile agent technique and its application in IDSs.After introducing the Aglet in mobile agent and analyze its system frame and object model, we introduce the design of the system architecture and expound the design and implementation of MADIDS in detail.At the end of this paper, we summarize the advantageand disadvantages of this system, and discuss the future research directions of MADIDS.更多还原