基于移动Agent的分布式入侵检测系统研究

【作者】 刘丽；

【导师】 杨振启；

【作者基本信息】 曲阜师范大学 ， 计算机应用技术， 2007， 硕士

【摘要】 随着网络技术的迅速发展和广泛应用，网络安全问题变得越来越重要。加密技术和防火墙等传统的安全技术已经无法满足网络安全的需要，入侵检测技术应运而生。入侵检测技术能够动态和实时的检测，并且具有响应功能。入侵检测系统是P~2DR(Policy Protection Detection Response)动态安全模型的一个重要组成部分。本文将移动Agent技术应用于入侵检测，在对入侵检测技术以及Agent技术深入分析的基础上提出了一种基于移动Agent的分布式入侵检测系统模型—DIDSBMA。DIDSBMA利用Agent的自治性、协作性、移动性等特点，有效的提高了入侵检测系统的可扩展性、检测速度以及检测的准确率。DIDSBMA的代理体系由数据收集代理、移动检测代理、状态检测代理组成。代理之间即相互独立又相互协作，合作完成入侵检测的任务。代理体系的引入，将基于主机的入侵检测和基于网络的入侵检测灵活的融为一体，形成一个统一的入侵检测系统。论文实现了DIDSBMA模型的部分具体功能，并对网卡的混杂模式进行了介绍，详细叙述了Agent之间的协作，并提出了一个新的协作实现模型—意向模型。最后对本文进行了总结。更多还原

【Abstract】 With the rapid development and abroad application of network technology, network security becomes more and more important. Traditional security technology such as encryption and firewall doesn’t satisfy proposed, which is dynamic and real-time processing, and has response function, Intrusion detection system is the part of Policy Protection Detection Response (P~2DR) security model.The thesis applied the mobile agent technology to the field of intrusion detection. Being based on the in-depth analysis of intrusion detection system model-DIDSBMA. DIDSBMA achieves including flexibility, high speed and accuracy by using the autonomy, collaboration and motion of agent technology.The agent system of DIDSBMA consists of Mobile Detection Agent, Data Collection Agent and Sate Detection Agent. Every agent works independently and together to accomplish intrusion detection. Due to the agent system, DIDSBMA comes into being a uniform intrusion detection system that is competent for the task of host-based and network-based intrusion detection.The portion function of DIDSBMA is stated in the thesis, and introduced the motley of network card. Then particularly stated the cooperation of agents, and bring forward a new cooperation model - intent model. Lastly, generalized all the thesis.更多还原