基于Agent人工智能的异构网络多重覆盖节点入侵检测系统设计

Design of Intrusion Detection System for Heterogeneous Networks with Multiple Coverage Nodes Based on Agent Artificial Intelligence

摘要:

异构网络具有结构复杂、多重覆盖面积大等特征,使得网络入侵检测较为隐蔽,为网络安全运行造成威胁,为此,设计基于Agent人工智能的异构网络多重覆盖节点入侵检测系统。通过检测Agent和通信Agent装设主机Agent,以Cisco Stealthwatch流量传感器作为异构网络传感器检测攻击行为,采用STM32L151RDT6 64位微控制器传输批量数据,由MAX3232芯片实现系统电平转化,实现硬件系统设计。软件部分设计入侵检测标准,利用传感器设备捕获网络实时数据,通过Agent技术解析异构网络协议并提取数据运行特征,综合考虑协议解析结果及与检测标准匹配度,实现异构网络多重覆盖节点入侵检测。通过系统测试得出结论:设计的基于Agent人工智能的异构网络多重覆盖节点入侵检测系统入侵行为的漏检率和入侵类型误检率的平均值仅为6%和5%,能够有效提高检测精度,减小检测误差。

Abstract:

Heterogeneous networks have complex structures and large multiple coverage areas, making network intrusion detection more covert and posing a threat to network security operation. Therefore, a heterogeneous network multi coverage node intrusion detection system based on Agent artificial intelligence is designed. By detecting agents and installing host agents through communication agents, Cisco Stealthwatch traffic sensors are used as heterogeneous network sensors to detect attack behavior. STM32L151RDT6 64 bit microcontroller is used to transmit batch data, and MAX3232 chip is used to achieve system level conversion, achieving hardware system design. The software part designs intrusion detection standards, utilizes sensor devices to capture real-time network data, analyzes heterogeneous network protocols through Agent technology, extracts data operation characteristics, and comprehensively considers protocol parsing results and matching with detection standards to achieve multiple coverage node intrusion detection in heterogeneous networks. Through system testing, it is concluded that the average missed detection rate and false detection rate of intrusion types in the designed heterogeneous network multi coverage node intrusion detection system based on Agent artificial intelligence are only 6% and 5%, which can effectively improve detection accuracy and reduce detection errors.