| With the ceaseless development of network, network security is becoming more and more important and many security technologies have been used in network security fields. But most security measures belong to passive defense and are lack of positive safeguard. Intrusion Detection is a kind of novel technology in network security system, which is a kind of active defense technology and is becoming the focus of computer and network security. It can detect the security leak of network in time and response rapidly and enhance the security of network.First, the article analyzes the current principle, classification and the technology of Intrusion Detection in common use and predicates the direction of Intrusion Detection development.Then, the article puts forward a kind of distributed and coordinated Intrusion Detection System model based on annular structure for characteristic and being not considering the priority of detection events in existing Intrusion Detection model, introduces the idea of managing and coordinating annular model through the token, gives the structure of the token, provides the computation and realizing method of event priority, and designs a set of perfect arithmetic of Intrusion Detection and the protocol of annular structure of distributed and coordinated Intrusion Detection system.At one time, the article provides the framework of distributed and coordinated Intrusion Detection system based on annular structure and the structure of realizing each function module, adopts the protocol analyse and the technology of mode matching to analyze intrusion, and puts forward the improved Boyer-Moore arithmetic to make the mode matching arithmetic more efficient,and constructs an emulational enviroment to validate the easy operation and good stability, reliability and expansibility and the better response ratio and load equilibria through the emulational experiments to achieve the expected results.Finally, the article summarizes the advantages and deficiencies of the distributed Intrusion Detection System based on annular structure and points out the function being not realized in the article and the further research direction for the future. |
