论文部分内容阅读
文中提出了一种具有自学习、自完善功能的入侵监测模型，可发现已知和未知的滥用入侵和异常入侵活动。在提出的模型中，移动Ａｇｅｎｔ将收集到的各个活动监测Ａｇｅｎｔ采集的数据发送给事件序列生成器，事件序列生成器将由此产生的事件序列提交给数据挖掘引擎进行证据发现，检测引擎对发现的证据和已有规则间的相似性进行评估后由决策引擎做最终的裁决，并据此维护规则库和对各个活动监测Ａｇｅｎｔ发出对抗指令。
In this paper, a self-learning and self-perpetuating intrusion monitoring model is proposed, which can detect known and unknown abuses and anomalies. In the proposed model, the mobile agent will collect the data collected by each activity monitoring Agent to send to the event sequence generator. The event sequence generator submits the sequence of events generated thereby to the data mining engine for evidence discovery. The detection engine detects the discovered Evidence and the similarity between the existing rules are evaluated by the decision engine to make the final ruling, and accordingly maintain the rule base and each activity monitoring Agent issued a counter directive.