Based On Mobile Agent Technology To Intrusion Detection System Design And Implementation

Intrusion detection technology has become an important research subject in the field of network security. The research of intrusion detection has grown considerably nowadays, and there are a large number of intrusion detection systems have been developed to address different needs. However, the traditional intrusion detection systems have some shortcomings in certain aspects, such as distribute, intelligent, flexibility, efficiency and so on.The IDS proposed in this thesis is based on mobile agent technique, by which IDS distributes data and tasks to the nodes in the networks. Thus IDS can make best use of compute capability and resources of the networks, which covers the shortage of conventional centralized intrusion detection approach. Moreover, this new architecture enables IDS to enhance detection capability and adaptability to intricate network environment through self-study and evolution. To achieve better accuracy, the architecture adopts security audit data gathered from both host and network. To enable IDS to detect both known and unknown intrusion model, the architecture adopts a blend frame that makes use of both misuse detection approach and anomaly detection approach. At first of the dissertation, the technology of IDS and mobile agent has been presented in detail. Then, the dissertation analyzes the requirement of the system, and confirms the development's environment. Secondly, It introduces the architecture in detail. In the end, another highlight of the architecture is introduction of anomaly detection technique.