关键词: 网络安全组件, 协同响应机制, 策略, IDMEF, IDXP

Abstract: To solve the problem that the network security systems cannot play overall advantages due to the lack of coordination mechanism among components, a policy-based collaborative response mechanism was proposed. The process of collaborative response was designed with the policy-driven model. The Intrusion Detection Message Exchange Format (IDMEF) was expanded to be the collaborative message format. A Blocks Extensible Exchange Protocol (BEEP)-based Intrusion Detection Exchange Protocol (IDXP) was implemented to communicate among security components. The collaboration module was programmed to implement the collaborative operations. An evaluation experiment on the collaborative response of security components was performed with this mechanism, and the time costs of each process were obtained. The experimental results demonstrate that the mechanism can implement the collaborative response of security components effectively.

Key words: network security components, collaborative response mechanism, policy, IDXP, IDMEF