高速网络环境下基于分布式协作代理的入侵检测系统研究

提出了一个高速网络环境下基于分布式协作代理的入侵检测系统模型框架，研究了一种面向大规模网络的分布式协作代理入侵检测技术，构建了一个能适应高速网络环境下网络监测的入侵检测系统集群模型，对其体系结构进行了详细的描述．为了提高入侵检测的识别率，在现有特征匹配算法的基础上，提出了利用网络协议的特征来提高入侵检测的匹配效率的方法和基于遗传算法的智能动态反馈负载均衡器的思想，利用它们来对高速网络环境下前端捕获的1Gbps以上的大数据流分流，以利于后端低速入侵检测系统及时并行处理，并总结出了模型实现的关键技术。

A Study on the Detection System of Network Intrusion Based on Cooperative Distributed Agent in High Speed Network

The framework model proposed in this paper is a high-speed network distributed cooperative detection system of intrusion based on agent. This paper studies the technology of big-scale network intrusion detection system based on cooperative distributed agent, and found a detection system of intrusion, which adapts to high-speed network module, and focuses on the system framework. In order to develop the precision of the detection system, this paper brings up a way which uses the character of network protocol to develop the matching efficiency of the detection and an idea based on the aptitude dynamic feedback load equalizer of inheritance algorithm. The back end to implement the slow speed detection system timely is used to distribute the big data stream which is captured in the high speed network's front. At last, this paper sums up some key technologies for realizing the model.