A New Distributed Intrusion Detection Method Based on Immune Mobile Agent

Intrusion detection system based on mobile agent has overcome the speed-bottleneck problem and reduced network load. Because of the low detecting speed and high false positive rate of traditional intrusion detection system, we have construct an immune agent by combining immune system with mobile agent. In the distributed intrusion detection systems, the data is collected mostly using distributed component to collect data sent for processing center. Data is analyzed in the processing center. this models have the following problems: bad real time capability, bottleneck, and single point of failure. In order to overcome these shortcomings, a new distributed intrusion detection method based on mobile agent is proposed in this paper, by using the intelligent and mobile characteristics of the agent. Analysis shows that the network load can be reduced and the real time capability of the system can be improved with the new method. The system is also robust and fault-tolerant. For mobile agent only can improve the structure of system, dynamic colonel selection algorithm is adopted for reducing false positive rate. The simulation results on KDD99 data set have proved that the new method has low false positive rate and high detection rate.

[1]  W. Hunteman.  Automated Information System (AIS) Alarm System , 1997 .

[2]  Julie Greensmith,et al.  Immune system approaches to intrusion detection – a review , 2004, Natural Computing.

[3]  D. Dasgupta,et al.  Mobile security agents for network traffic analysis , 2001, Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01.

[4]  Udo W. Pooch,et al.  A Methodology for Using Intelligent Agents to provide Automated Intrusion Response , 2000 .

[5]  Stefan Axelsson,et al.  Intrusion Detection Systems: A Survey and Taxonomy , 2002 .

[6]  Stephanie Forrest,et al.  Intrusion Detection Using Sequences of System Calls , 1998, J. Comput. Secur..

[7]  M. A. Maarof,et al.  Feature Selection Using Rough Set in Intrusion Detection , 2006, TENCON 2006 - 2006 IEEE Region 10 Conference.

[8]  Peter G. Neumann,et al.  EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances , 1997, CCS 2002.

[9]  Eugene H. Spafford,et al.  Intrusion detection using autonomous agents , 2000, Comput. Networks.

[10]  Byung-Joo Kim,et al.  Kernel based intrusion detection system , 2005, Fourth Annual ACIS International Conference on Computer and Information Science (ICIS'05).

[11]  Stephanie Forrest,et al.  A Machine Learning Evaluation of an Artificial Immune System , 2005, Evolutionary Computation.

[12]  Julie Greensmith,et al.  Immune System Approaches to Intrusion Detection - A Review , 2004, ICARIS.

[13]  Fabio A. González,et al.  An immuno-fuzzy approach to anomaly detection , 2003, The 12th IEEE International Conference on Fuzzy Systems, 2003. FUZZ '03..

[14]  Peter J. Bentley,et al.  Towards an artificial immune system for network intrusion detection: an investigation of dynamic clonal selection , 2002, Proceedings of the 2002 Congress on Evolutionary Computation. CEC'02 (Cat. No.02TH8600).