摘要： 当前的入侵检测技术主要有基于规则的误用检测和基于统计的异常检测。提出了一个多Agent入侵检测系统原型。在进行用户异常检测的同时，基于多数人侵者都是以已经确定的模式实施攻击这一事实，加入了网络入侵检测和特权程序执行追踪功能。可以利用多Agent的自治和合作来提高检测结果的准确性。各Agent用神经网络构造，可以利用其学习、快速识别和对噪音数据的处理能力，同时使系统具有更好的适应性。为了解决种经网络处理时间系列输入引起的拓朴和训练的复杂性，引入了事件滑窗来为神经网络提供输入，从而使用简单的前馈网络和BP算法即可获得较好的检测效果。

关键词: 安全, 入侵检测, 入侵检测系统, 神经网络

Abstract: The current intrusion detection techniqucs mainly include rule-based misuse detection and statistics-based anomal detection. Thispaper proposed an IDS with multiple agents. Based on the fact that most inmiders act in a determined pattcrn, our system prototype combinesthe functions of network detection and privileged program execuhon trace besides user anomal detection. The autonomy and co-operation ofthe agents help improve the accuracy of detection results. All agents are constructed with neural networks. Not only can itS capabilities oflearning, quick classification and processing of noisy data be used in intrusion detection, the system is also highly adaptive. In order toovercome the deficiency of series processing of neural networks, the event sliding-window is introduced for data input of neural networks.Better performance can be gained by only adopting simple feed-forward networks and BP algorithm.

中图分类号: 

• TP393