Intrusion Detection System, Based On Data Mining And Agent Technology

This dissertation focuses on a project of the architecture of an agents-based intrusion detection system (IDS). The IDS introduced in this dissertation is based on agent technique, so the system can distribute data and tasks to the nodes in the networks, instead of conventional centralized solutions. The one of the highlight of the architecture is introduction of data mining technique, and the other is introduction of genetic algorithms. The IDS uses data mining algorithms to abstract key features of system runtime status from security audit data, and it uses genetic algorithm to select the feature subset to reduce the amount of data that must be obtained from running processes and classified.Meanwhile, the dissertation introduces the architecture of the IDS in detail. There are the structure, function and relationship of all of the important modules being introduced downwards, such as DMA, HMA, IDA and so on.