一种基于移动代理的分布式入侵检测系统(MADIDS)设计思想

随着计算机和网络技术的普及和应用,计算机安全变得越来越重要.入侵检测是计算机安全体系结构中的一个重要的组成部分,但面对日益更新的网络环境和层出不穷的攻击方法,传统构建入侵检测系统的方法显得缺乏一定的有效性、适应性和可扩展性.本文借鉴了移动Agent技术,在将Agent技术引入入侵检测领域方面做出探索,提出了一种基于移动Agent的分布式入侵检测系统(MADIDS)的设计思想.该系统中将现在比较流行的轻量级入侵检测系统Snort与IBM的Aglet移动代理平台相结合,实现检测任务的分担,同时力求将基于主机与基于网络的入侵检测技术结合在一起,增强系统的检测能力.

A design thought for distributed intrusion detection system based on Mobile Agent

With the development of computer science and Internet technology, the issue of computer security becomes more and more important. Intrusion detection is one important part of the computer security system. However, with brand-new Internet situation and attack techniques, traditional methods to construct intrusion detection system seem to be not so efficient, adaptable and expandable. This paper, based on Mobile Agent technology, introduces Agent technology into intrusion detection and proposes a design thought for distributed intrusion detection system. This system takes advantage of the Agent of Snort and IBM and tries to improve the detection ability of the system.