一种基于协同调度的入侵检测框架

分析了现有入侵检测系统的不足，讨论了协作的必要性，介绍了一种多主体协同入侵检测框架。本框架采用分布检测和集中处理的结构、通用的警报格式和安全通信协议，由控制中心的调度引擎对协同请求、关联数据收集、警报和新规则的分发进行统一的调度管理。经过测试和应用，能够很好地实现多主体间的信息共享，完成协同检测。

Intrusion detection system framework based on collaborative dispatch mechanism

The shortages of current intrusion detection systems were analyzed, and the necessity of collaboration was discussed. A mutiagent collaborative intrusion detection framework was put forward. It adopted distributed detection and centralized analysis architecture, generic alert form and secure transfer protocol in this system, unified dispatch by coordinate engine to manage cooperative request, collect relative data and distribute alerts and new rules. This system can well implement information sharing among multiagents and achieve collaborative detection after test and application.