Abstract: To solve the problem that the network security systems cannot play overall advantages due to the lack of coordination mechanism among components, a policy-based collaborative response mechanism was proposed. The process of collaborative response was designed with the policy-driven model. The Intrusion Detection Message Exchange Format (IDMEF) was expanded to be the collaborative message format. A Blocks Extensible Exchange Protocol (BEEP)-based Intrusion Detection Exchange Protocol (IDXP) was implemented to communicate among security components. The collaboration module was programmed to implement the collaborative operations. An evaluation experiment on the collaborative response of security components was performed with this mechanism, and the time costs of each process were obtained. The experimental results demonstrate that the mechanism can implement the collaborative response of security components effectively.

Key words: network security components, collaborative response mechanism, policy, IDXP, IDMEF

摘要： 为解决由于组件间缺乏协同机制而无法充分发挥网络安全系统整体优势的问题,提出了一种基于策略的协同响应机制。基于策略驱动模型设计安全组件间的协同响应过程,通过对入侵检测消息交换格式(IDMEF)的扩展实现协同消息,采用块可扩展交换协议(BEEP)框架实现用于组件通信的入侵检测交换协议(IDXP),编程实现协同模块实施协同操作。运用该机制对网络安全组件的协同响应进行评估实验,获得各个阶段的时间开销。实验结果表明该机制能有效地实现网络安全组件的协同响应。

关键词: 网络安全组件, 协同响应机制, 策略, IDMEF, IDXP