Research of an Agent-based NIDS and it's XML communication realization
Li Han · 2004
An Agent-based Network Intrusion Detection Model is introduced. It consists of the following components: a host manager (a monitoring process or collection of processes running in background) in each host; a network manager for monitoring each net in the system; and a central manager which is placed at a single secure location and receives reports from various hosts and net managers to process and correlate these reports, and to detect intrusions. By the cooperation of agents, the cooperative attack in the net can be detected.A data exchange method using XML (Extensible Markup Language) technology is also introduced to realize the secure communication between agents.