入侵检测系统的数据收集机制研究

基于对入侵检测所采用的数据收集方法的分类和分析，提出了一种基于多代理的分布式数据收集模型，介绍了该模型的数据收集方法和协同检测过程，该模型分别在网络的关键入口处以及主机的重要应用和网络接口处部署检测代理，各检测代理根据不同情况采用不同的数据收集方法对各种可疑数据进行收集，并通过协调代理对下层检测代理提交的数据进行协同分析。结果表明，这种数据收集模型为协同检测奠定了基础，提高了对分布式攻击的检测能力。

Research on Data Collection Mechanisms for Intrusion Detection System

Based on the classification and analysis of different data collection methods used in intrusion detection. a model of multi agent in view of data collection is put forward, and the corresponding data collection methods and process of collaborative detection are introduced. This model deploys individually detection agents on the primary entrance of network and network interfaces of the hosts with the important applications. Every agent uses several respective methods to collect suspicious data over against the different situations, and coordination agent analyses cooperatively the data submitted by lower detection agents. It is shown that this model of data collection establishes the basis of collaborative detection and greatly improves the capability of detecting distributed attacks.