Abstract:

A message driven communication mechanism was proposed, which takes the role of transforming information, and cooperating to detect vicious behaviors. The communication models and algorithms of detector, manager and communicator were designed. The protocol presented here was divided into three layers. Then, the definitions of common used messages were given, and communication processes were designed in detail. In the end, doorknob attack was used for simulation. Experimental results showed the validity of this mechanism to detect intricate event.

Key words: intrusion detection, communication model, protocol