Research On Intrusion Detection And Response System

Intrusion Detection System is an active security technology developed in the recent decade, which integrates detection, audit, alert and response function. As an important part in information security mechanism, it supplies a gap for Access Control and Identity Authentication, thus becoming a main study area.In this thesis, the various intrusion detection models and detection methods are firstly categorized and studied, merits and defaults of which are discussed in detail, then the Intrusion Response System and Intrusion Traceback are studied. Based on the analysis of Autonomous Agent-based IDS and Mobile Agent-based IDS, a Multi-agent-based Intrusion Detection and Response System, MAIDRS, is designed, which not only has the advantages of both Autonomous Agent-based IDS and Mobile Agent-based IDS but also overcomes some their drawbacks. To solve the common problem of configuring agents in Agent-based IDS, an Adaptive Model Generation, AMG, is only designed theoretically for the agents using the ideal of Information Theory, which makes MAIDRS more efficient.