Immunity-Based Approaches for Self-Monitoring in Distributed Intrusion Detection System

In distributed intrusion detection systems, self-monitoring is a difficult problem. One possibility is that each intrusion detection system is checked periodically by others. In our previous research for the self-monitoring, we proposed mutual tests between intrusion detection system and mobile agent using an immunity-based diagnosis. However, we have not clarified advantages and disadvantages of using mobile agent. In this paper, we compare the approach using mobile agent with that using host-to-host communication. Some simulation results show that in comparison with the host-to-host communication, mobile agents need twice as much time to detect corrupted intrusion detection systems, whereas a smaller number of mobile agents can identify correctly.