基于资源的分布式入侵检测系统框架研究-计算机应用技术专业论文.docxVIP

广嚣大学颈±学位论文一——薹l一资涨鹩DIDS框巢磷览 广嚣大学颈±学位论文一——薹l一资涨鹩DIDS框巢磷览 摘要 三种资源检测Agent对入侵行为的协同响应，阻断入侵的扩大。 关键词 分布式入侵检测 资源代理资源检测通信协同 广嚣大学联』二攀位论文——基于赞灏船DiDS挺桨错究 广嚣大学联』二攀位论文——基于赞灏船DiDS挺桨错究 A珏Sl馘C} RESEARClI oN SYSTEM RESOURCE．BASED DIS霉RlBUTED lNTRUSloN DE霉裁CTIoN SYSTE兔垂 ABSTRAC罩 With the rapid development of computer technology and Internet，computer system has been shifted from stand-alone mode to an open Internet．The problems of network and information security emerging increasingly．Different kinds of attacking incidents the Internet keep happening．Consequently,more and more measures into being well。People attaching greater importanee to the intrusion detection technology． The thesis analyzes all kinds of intrusion detection technologies and several kinds of current intrusion detection system．Then resource—based distributed intrusion detection system is proposed。 From a management viewpoint，the computer system be categorized into file resource，program resource and network resource。According to their own e歉a1．ac垂eris耄耋cs。we design their appropriative detection unit(Agent)for them，namely network detection agent(NRA)，program detection agent (PRA)and file resource detection agent(rgA)．NRA detects the communication between inter-network and outer-network,PRA detects programs running the hosts and servers，FRA detect files 广珏天学颈D学位论文——基于餐瓣嚣DIDS撂梨研究 广珏天学颈D学位论文——基于餐瓣嚣DIDS撂梨研究 in the system。By the cooperation in these three kinds of Agents，the security protectiou of computer network system is accomplished． System syncretism advantages of host-based and network-based IDS． The distributed capability and the expansibility of that system are good enough to the complicated environment of the network． Then，this thesis presents detection technologies of the three kinds of detection Agent，proposes communication mechanism to implement information exchange among resource detection agents，and designs communication protocol accor