摘要： 提出了一种新的支持分布式入侵检测通信需求的通信机制。给出了通信机制的体系结构及其实现流程,提出了一种基于XML进行异构Sensor事件一致描述的方法,有效地解决了IDS之间数据共享的问题。针对IDS控制台和检测传感器之间安全数据交换的问题,提出了一种基于SSL和RSA算法相结合的安全通信解决方法。对本通信机制的性能进行了量化分析。

关键词: 入侵检测, 入侵检测消息交换格式, 安全套接层, XML

Abstract: A new kind of communication mechanism for distributed IDS is proposed. The paper gives the architecture and organization of the communication mechanism, proposes a universal descriptive method based on XML and IDMEF for different kinds of intrusion events so that it can solve the exchange problem in heterogeneous and distributed IDSs,a secure communication strategy based on SSL for the message exchange between sensor and console is also presented. The performance of the proposed communication mechanism is analyzed quantitatively.

中图分类号: 

• TP393