摘要： 采用分布式结构的基于网络的入侵检测系统(NIDS)自身的安全性已经成为一个重要问题。在分析了已有NIDS的技术特点的基础上，根据其特性引入了报文过滤、进程控制、报文确认和安全通信的思想，提出了面向NIDS的自保护代理(Self-protection Agent)的模型，并给出了SPA的体系结构与详细设计。在与已有的基于代理的入侵检测系统结合后，SPA可以提高NIDS的安全性。
关键词:
入侵检测系统,
基于网络的入侵检测系统,
自保护代理,
报文过滤
Abstract: The security of distributed network-based intrusion detection system (NIDS) has become the point of the security of the whole networks. Based on the analysis of the NIDS, the approaches of packet-filtering, processes-controlling, packet-confirmation and secure communications are adopted by self-protection agent (SPA) to improve the security of NIDS according to its technique feathers. The architecture and the detailed design of the SPA are presented. Also, a prototype SPA is implemented , which has been used to cooperate with the agents-based NIDS to improve the security of the NIDS.
中图分类号:
朱树人,黄辰林,李伟琴. 分布式入侵检测系统中自保护代理的系统设计[J]. , 2003, 29(16): 22-24.
ZHU Shuren1,2,HUANG Chenlin3,LI Weiqin1. Design of the Self-protection Agent for Distributed Network-based Intrusion Detection System[J]. , 2003, 29(16): 22-24.