Mobile Agent Is Applied Research In Intrusion Detection

Mobile Agent Based Intrusion Detection System (MABIDS) is one sub-subject of "Network Attack and Defense Technology", a national fundamental research project. The task is to study the feasibility of applying Mobile Agent to Intrusion Detection, by means of designing and implementing an experimental framework of Intrusion Detection system based on Mobile Agent. It's a new exploration in the field of Distributed Intrusion Detection.In design of the system, I referred to the researching, designing methods and testing standards of similar projects on the same subject. Thereby I designed the hierarchical logic structure of the MABIDS and divided the system into 4 components: GUI, Manager, Analyzer and Probe. Then, the Configure structure and Message system was devised.The system was constructed on the Aglet platform, the mobile agent product of IBM. Making full use of the Object-Oriented feature of Java, I designed the class hierarchy of all system components. For the purpose of test, several classic Intrusion detection agents were constructed.To test the system, four agents implemented in the last step were selected for testing. Major features of the system were tested. The main task of this step is designing and carrying on the test of scalability and ID performance in several different cases.The result told us IDS based on MA is a great idea for the evolvement of IDS. It can contain all the existing technology and provide us new functions such as manageability, scalability, better performance and the ability of distributed detection.