Distributed Intrusion Detection System With Learning Mechanism

As computer network and communication technology develop high speed, people has relied on Internet increasingly, the issue of security is becoming more and more important. Nowadays, distributed intrusion detection system research based on the technology of agent and neural network becomes hotspot, software agent technology is considered as a very tool to develop intrusion detection system, especially its characteristic of Autonomy, Social Ability and Adaptability, and neural network technology gains more and more focus in respect that its pre-estimation to unknown network activities.Based on the summary of current mainstream IDS researches, a Distributed Intrusion Detection Model Based on Multi-agent is constructed, agent technology, middle-ware technology and neural network technology are incorporated to establish its overall structure, and components, which are based-host and base-network, have been provided, to endorse the fluency of coordination between Agents in this system. In respect that there is no controlling center in this system, all of intrusion detection task is completed with the coordination between Agents. Since the traits of Agent owned by itself (autonomy, individuation, sociality), this system can be extended with new coordinated nodes and detection modes. Neural network technology is chosen to develop intrusion detection engine based network, which can find some unknown attack patterns. Coordination theory is used to establish communication estimation mechanism, which can evaluate the possibility of attack between Multi-agent withintrusion detection alarm level coming from different nodes. Accordingly the fusion of agent technology and neural network technology is discussed to some degree.On this condition, an experimental system to do some experiments is developed. As the result demonstrates, the system can implement distributed intrusion detection system and this system is of ability of learning as well.Finally, the author propose the plan for next step of the research and how to consummate this IDS step by step.