Research And Distributed Intrusion Detection System Detects Agents

With intrusion detection technology explored, and the cause of some important issues in intusion detection field that must be resolved immediately annalyzed, an Enhanced Intrusion Detection Agent (E_NIDA) , , is presented, which works under the Agent-based Distributed Intrusion Detection framework, with an enhanced detection engine inside, and obtaining decision-making information from an Assistant Information Collecting Agent (A_ICA) . With cooperation of E_NIDA and A_ICA, the performance of intrusion detection system can be improved and false positives can be mitigated drastically.A_ICA is responsible for collectiing informaiton of system or application server software of hosts in subnet monitored, which are provided for help the E_NIDA making decisions. A_ICA recognises system of application softwares' name and version by several means including "fingerprint" identifying technique, and produces a profile of each host. Multi-process mechanism improves its performance and Plug-in mechanism gives it a better expansibility.E_NIDA detects intrusion by signature-based pattern-match. Protocol analysis and decision-making information helps improve detection speed, by minimizing the scope of search and reducing the frequency of match. With extended intrusion signatures, E_NIDA generates much less false positives.E_NIDA and A_ICA are implemented in prototype. In pairs controlled by a certer console, they can be deployed in arbitary number, that brings the whole system good distribute and scalable ability. A_ICAs, E_NIDAs, a datamining agent and a center console compose a whole intrusion detection system, which is proved a feasible and effective intrusion detection system by practical test.