| Grid is a seamless, high efficient, standard, multi-user-collaborating distributedcomputing environment, which is formed through organizing computing resources atdifferent geography sites into a framework unitedly and linking them by high-speedInternet. Considering the isomerism of the resources, the extendibility of the scale, theadaptability of grid resource management policy and unpredictability of the systemstructure, the security requirement of grid computing environment is higher than thatof Internet. The traditional grid security authentication mechanism has been verydifficult to satisfy the existed security requirement of grid. Therefore, it is necessaryfor a new type of intrusion detection system with good structure, high reliability andhigh scalability to exert important effect in resolving the increasing security problemof grid.In this paper, a grid-oriented intrusion detection system is designed basing on theanalysis about LCG grid platform of Institute of High Energy Physics. Its model isdivided into two layers. The first one is the common node layer while the second oneis the super node layer. The common node layer is in charge of collecting thecharacteristic data of user action, and deploying NIDS on the critical networksegments, and then sending these data to super node layer for farther analysis. Thesuper node layer is in charge of processing assistant analysis on the data sent from thecommon node layer. In this layer, because there are differences among the function ofdata preprocess engine and of the data analysis engine and the size of the data beingprocessed, it is necessary to add a resource load cooperation model to avoid the bottlesituation. Simultaneously, the super node layer can also commit some computingwork in the form of grid tasks to grid for analysis and computing. In this way, theefficiency of intrusion detection for the whole grid is improved effectively.Among the clustering algorithms, the k-means is the most famous andfrequently-used one. It is suitable to partition magnanimity data, and has the featuressuch of high constringency speed etc. However, it is dependent on the initialdistribution of the clustering center and the partition cluster number, thus it has aunsatisfied effect on magnanimity data. To ameliorate this, some people have introduced the artificial intelligence algorithms (e.g. particle swarm algorithm) withpowerful global optimization function into the clustering algorighms, and has offsetits shortage some degree. Basing on these works, this paper improves the particleswarm algorithm farther more. The main idea is as follows:1. The existed improved particle swarm algorithm is basing on speed-site researchmodel, and it has the shortage such as low constringency speed and getting localoptimization resolution prematurely, etc. To overcome these, drawing lessons fromthe idea of speed-less vector particle swarm algorithm, a speed-less vector particleswarm algorithm with mutation operator in this paper. With introducing mutationoperator, the diversity of particle is enhanced.2. A new type of adaptation function intrusion-detection-training-set-oriented is putforward.3. The speed-less vector particle swarm clustering algorithm with mutation operatoris connected with the main-slave parallel model. Simultaneously, a new siteupdate formation is put forward, which can be applied to grid effectively andmakes the computing resources and store resources to be used sufficiently. |
