论文信息 - Preemptive distributed intrusion detection using mobile agents

Preemptive distributed intrusion detection using mobile agents

Distributed intrusion detection systems have many advantages over their centralized counterparts such as scalability, subversion resistance, and graceful service degradation. However, an important disadvantage is their inability to block packets immediately when an intrusion is detected To tackle this problem, we propose a network-based preemptive distributed intrusion detection system using mobile agents. Packets are diverted to various types of agents strategically placed over the network. Various agents perform tasks in control, detection, policy, and blocking. Suspect packets are blocked before they reach the destination when an intrusion is detected and the policy verdicts for blockage. Ways to mitigate negative impacts of our system on network traffic and latency are discussed.

Victor K.-W. Wei | P. C. Chan

[1] Biswanath Mukherjee,et al. DIDS (distributed intrusion detection system)—motivation, architecture, and an early prototype , 1997 .

[2] John McHugh,et al. The 1998 Lincoln Laboratory IDS Evaluation , 2000, Recent Advances in Intrusion Detection.

[3] John Mhugh. The 1998 Lincoln Laboratory IDS evaluation : A critique , 2000 .

[4] Biswanath Mukherjee,et al. A system for distributed intrusion detection , 1991, COMPCON Spring '91 Digest of Papers.

[5] Vasant Honavar,et al. Lightweight agents for intrusion detection , 2003, J. Syst. Softw..

[6] Eric Miller,et al. Testing and evaluating computer intrusion detection systems , 1999, CACM.

[7] Luci Pirmez,et al. Micael: An Autonomous Mobile Agent System to Protect New Generation Networked Applications , 1999, Recent Advances in Intrusion Detection.

[8] Magnus Almgren,et al. Application-Integrated Data Collection for Security Monitoring , 2001, Recent Advances in Intrusion Detection.

[9] Stefan Axelsson,et al. The base-rate fallacy and its implications for the difficulty of intrusion detection , 1999, CCS '99.

[10] Eugene H. Spafford,et al. Intrusion detection using autonomous agents , 2000, Comput. Networks.

[11] Salvatore J. Stolfo,et al. A data mining framework for building intrusion detection models , 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344).