Correlation-based hierarchical distributed intrusion detection system

Abstract

The invention relates to a correlation-based hierarchical distributed intrusion detection system, which is technically characterized by comprising a plurality of intrusion detection systems; each intrusion detection system consists of a detection agent subsystem, a distributed cooperation subsystem and an IDXP communication protocol module; intrusion detection information interaction is carried out between the detection agent subsystem and the distributed cooperation subsystem and between the intrusion detection systems through the IDXP communication protocol modules; and the distributed cooperation subsystem is provided therein with a correlation-based distributed cooperation model. The system is reasonable in design, constructs a cooperation model based on the correlation between agents, uses an IDXP communication protocol in intrusion detection standardization, can effectively resist more and more complex attack means, effectively reduces the distributed cooperation cost of the system while guaranteeing the system detection accuracy, and has the characteristics of strong fault-tolerant capability, easy system expansion, wide detection range and the like.

Description

technical field [0001] The invention belongs to the field of network communication and relates to network intrusion detection technology, in particular to a correlation-based hierarchical distributed intrusion detection system. Background technique [0002] Network intrusion refers to any behavior that attempts to destroy the integrity, confidentiality and availability of resources, including the misuse of system resources by users. With the expansion of Internet coverage, the rapid growth of the number of users, and the continuous development of network technology, various attacks and damages to the network are becoming more and more serious. As the second line of defense behind the firewall, intrusion detection has become an important part of modern network security technology. component. [0003] At present, the solutions adopted to solve network security problems generally include firewalls, data encryption, authentication, etc. These measures have a good preventive eff...

AI Technical Summary

Problems solved by technology

[0004] With the expansion of network scale and the increase of complexity of intrusion methods, it is difficult for a single intrusion detection system (IDS) to effectively defend against intrusion attacks

However, different vendors cannot cooperate with each other, resulting in a large-scale heterogeneous network environment, and inevitably there are security holes.

In the high-speed network environment, in the face of increasingly complex attack methods, a single intrusion detection system is already difficult to do

Images