CAJ | 학술논문

本文首先指出了将Agent技术应用于入侵检测系统的优势,依据入侵检测系统的特,点给出了主机的状态转换图,并提出了一个入侵检测模型,该模型的主机中有数据异常检测Agent、特征提取Agent、数据一致性检测Agent、完整性检测Agent以及日志处理.Agent通过学习机制建立行为库.对行为库里的信息进行推理获得入侵规则信息并将其加入到入侵规则库.最后用Aglet技术对该模型进行了仿真和实现,得出基于Agent的入侵检测技术具有较高的检测率及较低的误报率.
본문수선지출료장Agent기술응용우입침검측계통적우세,의거입침검측계통적특,점급출료주궤적상태전환도,병제출료일개입침검측모형,해모형적주궤중유수거이상검측Agent、특정제취Agent、수거일치성검측Agent、완정성검측Agent이급일지처리.Agent통과학습궤제건립행위고.대행위고리적신식진행추리획득입침규칙신식병장기가입도입침규칙고.최후용Aglet기술대해모형진행료방진화실현,득출기우Agent적입침검측기술구유교고적검측솔급교저적오보솔.
In this paper, we point out the advantages of using agent technology intrusion detection system at first. State transformation graph of host is shown then. An intrusion detection framework is designed. There are data anomalous agent, character extraction a-gent, data consistency agent, integrated agent and log process in host. Agents found action base through "learning. Through reasoning to action base agent gets intrusion information and appends the information to intrusion rules base. Finally, simulation and implemen-tation of the framework are done using aglets technology. The conclusion is gotten that intrusion detection based on agent has higher detection efficient and lower wrong report.