The Design And Implementation Of Audit System Based On Multi-Agent

ISA (Information System Audit) is one of the important teaches to ensure the security of information system. With the tendency of the development to the large scale distributed information system, types of auditing events increase greatly, the traditional, centralized auditing in single aspect cannot meet the requirement of the development of information system. At the same time, the auditing quantities of memorizing increase drastically, the centralized auditing analysis has to consume superfluous resources and bandwidth of information system, which badly tamper with efficiency of systems' efficiency. It burdens the administrators of system heavily to analyze the audit event. With the operation of information system extending dynamically, the strict-coupling architecture of traditional audit systems is hard to accommodate the requirement of the operations' expansibility. Agent is with characteristic of autonomy, intelligence, cooperation, etc. The audit system based on multi-agent has the unique predominance to solve the complicated, dynamic, distributed and intelligent application process. So to research the Agent technologyies and design the audit system based on multi-agent is a a new approach and method.In this thesis, the ISA and the Agent technologyies are deeply researched. According to requirements of ISA and characteristics of distributed information systems, the design scheme is presented and the audit system's architecture is constructed, which can collect distributed and multi-layer data and surpervise the condition of information system intelligently. This architecture has the better agileness and expansibility. The communications mechanism is designed to solve the dynamic communications' information of the system. The cooperation mechanism is designed and an algorithm of cooperated ratiocination is proposed in particular to realize the scheme of distributed audit analysis with multi-agents' cooperation. In this way, the audit data which is stored in distributed has been audited and analyze in distributed mode avoiding transmission of large numbers of data in network that lead to the bottleneck in network. Then the correctness and Real-time mechanism are ensured by time validation mode and the Goal function. At last the thesis discusses the key technologies and design approaches, and then achieves the main function of the audit system.