| 摘要: |
| 提出了一种能够精确描述入侵检测技术的综合分类方法,针对多管理域环境设计了一个分布式协同入侵检测系统(distributedcooperativeintrusiondetectionsystem,简称DCIDS),通过不同管理域IDS(intrusiondetectionsystem)之间高效安全的通信,实现协同检测.介绍了DCIDS的系统结构和4个组成部分:传感器、分析器、管理器以及用户界面,并讨论了系统实现中的安全通信、入侵检测点的选择等关键问题. |
| 关键词: 网络安全 分布式协同入侵检测 网络管理 认证 访问控制 |
| DOI： |
| 分类号: |
| 基金项目:国家863高科技发展计划资助项目(863-306-ZD08-01-3) |
|
| Design and Implementation of a Distributed Cooperative Intrusion Detection System |
|
DUAN Hai xin,WU Jian ping
|
| Abstract: |
| An integrative taxonomy for intrusion detection technologies is proposed in this paper, which can specify accurately existing intrusion detection methods. Aiming at multiple-domain environments, a distributed cooperative intrusion detection system (DCIDS) is designed, which implements cooperative intrusion detection through efficient, secure information exchange among IDSes in different domain. The architecture of DCIDS is described, as well as its four components: sensor, analyzer, manager and user-interface. Some key issues are also discussed, including secure communication and selection places. |
| Key words: network security distributed cooperative intrusion detection network management authentication access control |
