基于IDMEF的大规模协同IDS架构

IDMEF-Based Architecture of Large-Scale Cooperative IDS System

摘要: 为了实现IDS系统的分布化、协同化和标准化，入侵检测消息交换格式(IDMEF)相关标准已被广泛地应用到IDS领域中。该文讨论了一种基于IDMEF标准的大规模协同IDS构架，对基于Prelude框架和开发包的IDS协同系统进行了分析、设计和实现，并研究了该架构在CERNET网络中的部署和应用方法。经初步应用证明，该系统可以基本满足需求，达到了IDS的分布化、协同化和标准化的要求。

Abstract: Intrusion detection message exchange format (IDMEF) standard has been widely used in intrusion detection system (IDS). This paper proposes an architecture of large scale cooperative IDS based on IDMEF. The design and implementation of the cooperative IDS are discussed by the means of Prelude framework and development suite. The deployment and application of this architecture on CERNET are finally analyzed.