An active network-based intrusion detection and response systems

The network security is getting more important because of increasing worms and network attacks. More and more security mechanisms are introduced to protect from attack, such as firewalls and intrusion detection systems (IDS). This paper proposes an active network programming model. Comparing to a traditional network, active network gives the nodes programmable ability. It adopts the active network technology. The response, service deployment and service update schemes rely on this technology. The proposed intrusion detection and response system (WRS) can stop attacks at the first line and respond as fast as possible to reduce the damage caused by intruders. It provides the abilities of detection, report and response. The proposed prototype system adopts the novel data mining technology-support vector machine to enhance the detection function.