The Model Of Intrusion Detection Ased On Intelligent Agent

With the rapid development of the computer and network technology, computer security is increasingly more important. The intrusion detection is an essential component of the security infrastructure protection mechanisms; But in the face of rapid changed, updated network environment and various new attack methods, to some extent, the traditional IDS are limited in the effectivity and extensibility and adaptability.This thesis describes a method of building model for intrusion detection that is based on intelligent agent technology. It combines agent technology with data mining technology. The agents of the system cooperate one another. Raw audit data of the system or network is first preprocessed into records with a set of basic features. Then the association algorithms and the frequent algorithms are used to compute the frequent patterns from the records, which are the basis for building or selecting system features. Then, we can compare the current action pattern with the pattern in the pattern database to find out the known or unknown misuse intrusions and anomaly intrusions. The system model is extensible for adding new intrusion detection agents or new intrusion models. It adopts data mining technology to cut down the dependency of manual encoding and expert experience.In the end, the effectiveness of association rules is evaluated in an experiment.