Application Of Mobile Agent In Distributed Intrusion Detection Systems

With the rapid development of computer network technique, security problem has become the main focus that people care about. As the strong supplement of Firewall, Intrusion detection systems can detect attacks from both outside and inside of networks, and they should be an important part of the perfect security architecture.The research of intrusion detection has grown considerably nowadays, and a large number of intrusion detection systems have been developed so as to satisfy different needs. However, the traditional intrusion detection systems(IDSs) have some shortcomings in certain aspects, such as flexibility, interoperability etc.Therefore,people begin to seek for new technologies to improve the performance of IDSs.In this thesis, we try to introduce Mobile Agent technique into IDSs to improve their flexibility, interoperability, extensibility as well as their real-time performance. We also presented a distributed intrusion detection system based on mobile agent-MADIDS, which combines the IDS Snort and mobile agent platform Aglet.In MADIDS,the detection tasks are implemented by two types of detection mobile agents, which enable the system have certain flexibility,interoperability and intelligence as well as good performance.Firstly, we analyze and summarize the technologies of IDS and mobile agent.Then we put an emphasis on mobile agent technique and its application in IDSs.After introducing the Aglet in mobile agent and analyze its system frame and object model, we introduce the design of the system architecture and expound the design and implementation of MADIDS in detail.At the end of this paper, we summarize the advantageand disadvantages of this system, and discuss the future research directions of MADIDS.