Flow characteristic analysis-based distributed intrusion detection method

Abstract

The invention discloses a flow characteristic analysis-based distributed intrusion detection method. The method comprises the following steps of: performing intrusion detection based on a JADE platform by using an intelligent decision analysis agent and a data acquisition and independent intrusion condition monitoring agent; detecting a definite network intrusion action for an intrusion characteristic by using the data acquisition and independent intrusion condition monitoring agent; and comprehensively monitoring different statistical characteristic quantities comprising a flow bandwidth, a new source IP (Internet protocol) address and the like in network flow by using the intelligent decision analysis agent through an improved non-parameter cumulative sum (CUSUM) algorithm, namely, a threshold regression algorithm and realizing network abnormity detection in combination with related information transmitted by the data acquisition and independent intrusion condition monitoring agent so as to effectively enhance intrusion detection efficiency and accuracy. In the method, different network flow models can be differentiated effectively by monitoring the new source IP address, so that the misstatement rate of the intrusion detection system is further lowered.

Description

【Technical field】 [0001] The invention proposes a high-performance abnormal-based distributed intrusion detection method for detecting various attacks suffered by computer network systems. 【Background technique】 [0002] Intrusion detection refers to a security technology that collects information from several key points in a computer network or computer system and analyzes it to find out whether there are behaviors that violate security policies and are attacked in the network or system. Technically, intrusion detection methods are divided into anomaly-based detection and misuse-based detection. Detection methods based on misuse can only effectively detect known intrusions, but cannot detect new intrusions. However, the traditional anomaly-based detection methods also have the defect of high false alarm rate caused by the difficulty in defining and judging abnormal behaviors. [0003] In terms of intrusion detection technology, in recent years, people have carried out a l...

AI Technical Summary

Problems solved by technology

[0011] In order to overcome the problems of low detection accuracy and detection efficiency of traditional intrusion detection methods, the patent of the present invention proposes a distributed intrusion detection method based on a specific traffic detection algorithm, which mainly includes two parts; one is to propose an efficient traffic-based feature analysis The intrusion detection algorithm; the second is to propose a distributed multi-agent architecture, using the distributed framework and architecture to improve the efficiency of intrusion detection

Images