基于免疫原理的入侵检测技术研究

文中在深入分析免疫原理的基础上,提出了一个分层检测的分布式入侵检测系统模型。模型采用提取检测规则库中的规则生成自动匹配的四层检测规则集,经反向筛选后分别注入对应检测层的移动检测代理(MDA),MDA迁移到各检测代理子结点处协同完成入侵检测和响应,实现免疫特性。具有这样免疫特性的多代理能对大流量的分布式网络进行分层检测和响应,能在局部和全局的不同层次上检测入侵攻击,具有较好的自适应性、可扩展性和智能性。

Research on Intrusion Detection Technology Based on Theory of Immunity

A kind of delamination-detection and distributed IDS model based on complete analyzing the immunity theory is put forward.The model has the characters of real-time,self-adaptability,expansibility,intelligence because the model can realize immunity by creating the auto-matching detection rule collection by adopting four layers divided from the detection rule database.After these detection rule collections are reverse-filtered they are separately injected the mobile detection agent(MDA) which has corresponding detection rule collection.Then these MDAs corporately execute intrusion detection and response.Having the immunity,the multi-agents can carry out delamination-detecting and response to the great-flux and distributed network,and can dectect the intrusion and attack in local and whole network.