Static secure techniques, such as firewall, hierarchy filtering, distributed disposing,layer management, autonomy agent, secure communication, were introduced in distributed intrusion detection. The self-protection ag...Static secure techniques, such as firewall, hierarchy filtering, distributed disposing,layer management, autonomy agent, secure communication, were introduced in distributed intrusion detection. The self-protection agents were designed, which have the distributed architecture,cooperate with the agents in intrusion detection in a loose-coupled manner, protect the security of intrusion detection system, and respond to the intrusion actively. A prototype self-protection agent was implemented by using the packet filter in operation system kernel. The results show that all the hosts with the part of network-based intrusion detection system and the whole intrusion detection system are invisible from the outside and network scanning, and cannot apperceive the existence of network-based intrusion detection system. The communication between every part is secure. In the low layer, the packet streams are controlled to avoid the buffer leaks exist ing in some system service process and back-door programs, so as to prevent users from misusing and vicious attack like Trojan Horse effectively.展开更多
随着入侵检测系统(Intrusion Detection System——IDS)性能的逐步提高,攻击者往往在入侵目标网络之前攻击IDS,使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上,提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的...随着入侵检测系统(Intrusion Detection System——IDS)性能的逐步提高,攻击者往往在入侵目标网络之前攻击IDS,使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上,提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的IDS模型,并指出了将当前的分布式IDS转换成此模型的配置方法。展开更多
The nature of adhoc networks makes them vulnerable to security attacks. Many security technologies such as intrusion prevention and intrusion detection are passive in response to intrusions in that their countermea- s...The nature of adhoc networks makes them vulnerable to security attacks. Many security technologies such as intrusion prevention and intrusion detection are passive in response to intrusions in that their countermea- sures are only to protect the networks, and there is no automated network-wide counteraction against detected intrusions, the architecture of cooperation intrusion response based multi-agent is propose. The architecture is composed of mobile agents. Monitor agent resides on every node and monitors its neighbor nodes. Decision agent collects information from monitor nodes and detects an intrusion by security policies. When an intruder is found in the architecture, the block agents will get to the neighbor nodes of the intruder and form the mobile firewall to isolate the intruder. In the end, we evaluate it by simulation.展开更多
作为一种无中心分布控制网络— ad hoc网络 ,它的安全特性对安全防范提出了更高的要求 .入侵检测技术作为安全防范的第二道设施 ,是 ad hoc网络获得高抗毁性的必要手段 .提出了 ad hoc网络的安全性 ,在描述入侵检测技术的相关内容基础...作为一种无中心分布控制网络— ad hoc网络 ,它的安全特性对安全防范提出了更高的要求 .入侵检测技术作为安全防范的第二道设施 ,是 ad hoc网络获得高抗毁性的必要手段 .提出了 ad hoc网络的安全性 ,在描述入侵检测技术的相关内容基础上 ,针对 ad hoc网络提出多层分布式入侵检测技术的具体实现 :MAIDS(Mobile Agent Intrusion Detection System) .MAIDS是基于信任的簇划分机制下的多层分布式入侵检测系统 .展开更多
文摘Static secure techniques, such as firewall, hierarchy filtering, distributed disposing,layer management, autonomy agent, secure communication, were introduced in distributed intrusion detection. The self-protection agents were designed, which have the distributed architecture,cooperate with the agents in intrusion detection in a loose-coupled manner, protect the security of intrusion detection system, and respond to the intrusion actively. A prototype self-protection agent was implemented by using the packet filter in operation system kernel. The results show that all the hosts with the part of network-based intrusion detection system and the whole intrusion detection system are invisible from the outside and network scanning, and cannot apperceive the existence of network-based intrusion detection system. The communication between every part is secure. In the low layer, the packet streams are controlled to avoid the buffer leaks exist ing in some system service process and back-door programs, so as to prevent users from misusing and vicious attack like Trojan Horse effectively.
文摘随着入侵检测系统(Intrusion Detection System——IDS)性能的逐步提高,攻击者往往在入侵目标网络之前攻击IDS,使其丧失保护功能。在当前常用的分布式入侵检测系统的基础上,提出了一种能够对抗拒绝服务(Denial of Service——DoS)攻击的IDS模型,并指出了将当前的分布式IDS转换成此模型的配置方法。
基金This project was supported by the National Natural Science Foundation of China (60672068)the National High Technology Development 863 Program of China (2006AA01Z436, 2007AA01Z452.)
文摘The nature of adhoc networks makes them vulnerable to security attacks. Many security technologies such as intrusion prevention and intrusion detection are passive in response to intrusions in that their countermea- sures are only to protect the networks, and there is no automated network-wide counteraction against detected intrusions, the architecture of cooperation intrusion response based multi-agent is propose. The architecture is composed of mobile agents. Monitor agent resides on every node and monitors its neighbor nodes. Decision agent collects information from monitor nodes and detects an intrusion by security policies. When an intruder is found in the architecture, the block agents will get to the neighbor nodes of the intruder and form the mobile firewall to isolate the intruder. In the end, we evaluate it by simulation.
