基于自适应信任报警关联的P2P覆盖IDS

随着计算机网络安全需求的日益增长,分布式入侵检测技术成为一个至关重要的研究方向.但传统的分布式入侵检测系统仍存在一些缺陷,如在分布性、灵活性、协作性、检测效率和内部威胁应对等方面还不尽人意.为能更好地应对各种内部威胁,提出了一种基于自适应信任报警关联的对等覆盖入侵检测系统.在JXTA对等架构基础上实现了一个对等覆盖IDS原型,并在仿真网络环境中评估了该原型在检测应对Internet蠕虫传播和感染中的有效性.实验结果显示,该对等覆盖IDS能明显提高脆弱网络节点的平均幸存率.

Study on adapt ive trust a lert corre lat ionP2P overlay IDS

With the increasing dem and o f com pu ter ne tw o rks secu rity, the d ist ribu ted int rusion de tect ion techno logy becom e s an im po rtan t research area. H ow ev er, the t radit iona l distribu ted in t rusion de tect ion sy stem s have som e sho rtcom ing s in ce rta in aspect s, such a s dist ribut iv ity, f lex ib ility, in te roperab ility, detect ing e f ficiency, and inside r th rea t av o idance etc. T o dea lw ith the in sider th rea t m o re ef fect ive ly, P2P o ver lay IDS based o n an adap t iv e tru st a lert co rre la t ion w as propo sed. U nde r JXTA P2P f ram ew o rk, a P2P ov er lay IDS p ro to type sy stem w a s im p lem ented, and its ef fectiv eness to prev en t the spread o f a real In terne tw o rm w as ev alua ted ove r an em u la ted netw o rk. T he exper im en t resu lts show the P 2P ove rlay IDS sign if ican t ly increases the ove ra ll su rv iv al ra te o f vu lnerab le pee rs in netw o rk.