Research And Implementation Of A CORBA-based Distributed Network Intrusion Detection System

After analyzing and researching current distributed intrusion detection model, we propose a CORBA-based distributed intrusion detection model, of which its functionality, architecture, and components are deeply discussed. Based on the model, we design and implement a CORBA-based distributed network intrusion detection system (CDNIDS), which combines the IDS technique and distributed computing technology, integrates misuse detection method and anomaly detection method, and can perform several types of response. The system has strong real-time character, good operation system independent, and can be dynamic configured.The work of our research is mainly about:Analyze the drawbacks of current network security model, and discuss the way to solve these problems. What's more, we emphasize on the problems in DIDS, and discuss the main technology of IDS development.Discuss the security problems in CORBA, and propse a CORBA-based DIDS model, which is deeply analyzed.Based on our model, we design and implement a DNIDS, called as CDNIDS (CORBA-based Distributed Intrusion Detection System). The system is composed of several components. To each component, the design and implementation are described in detail.Summarize the advantages of applying CORBA technology to IDS. Base on the research result, we also put forward the system's development trends and directions.CDNIDS has good features, for example, its open architecture, good distribute ablility, real-time response, and good scalibility. It has good application prospects in large-scale and complicated network environment.