Collaborative intrusion detection based on coordination agent
Ran Zhang, Depei Qian, Heng Chen, Weiguo Wu · 2004
Based on the analysis of characteristics of current attacks, a collaborative intrusion detection model using coordination agent is proposed. Then we define the inner structure of intrusion detection agents, introduces its collaboration principle and security solution. On the basis of the above research, an effective algorithm of collaborative detection is put forward. In this model, the complicated collaboration task is finished by some separate coordination agents, which are responsible for synthetically analyzing the detection task that the lower agents are unable to finish and are able to assign the task to the lower associated agents. It not only simplifies the building of detection agents and improves the extent and efficiency of collaboration, thus overcoming the shortcomings of direct collaboration among agents in traditional methods, but also enhances the capability of detecting complex attacks. At the same time, an example shows the feasibility and validity of the model and the algorithm.