Research On Application And Fault-Tolerant Mechanism Of Agent In Intrusion Detection System

With the increasing popularity and development of network technology, the danger of network intrusion is growing. The Intrusion Detection is a new security technology, apart from traditional security technologies, such as"firewall"and"data encryption". Intrusion Detection System (IDS) use to detect the intrusion activities, which come from network.On the basis of research and analysis of the common IDS, we found the IDS have a number of components, and all components of IDS are very ineffective or attacked. Once any component failure, IDS would be leaded to a partial or complete paralysis, and the system would open to any aggressor.A new intrusion detection system, which is based on existing mobile agent intrusion detection systems, has been designed to resolve the above issues. The IDS contains 2 kinds of agents. One is static agent and another is mobile agent. Static agent's primarily responsibilities are managing system-wide mobile agents, and dealing with the intrusion of detection; Mobile agent migrate among different hosts according to certain itinerary to collect the information. Both of the agents focus on their own tasks, and cooperate with the others. Considering main backup module, once execution module, slipping window module and the characteristics of agent's work, fault-tolerant,recovery mechanism have been designed for each agent to realize the robustness for IDS.Consider all these, with the utilizing of recovery mechanism, the safety and robustness of the system are improved greatly when the IDS based on agent does not influence net-band and detection effectiveness. The IDS framework model is designed. It also provides a method for the design of similar system.