APA: An Interior-Oriented Intrusion Detection System Based on Multi-agents

Considering some employees in the department abuse their privilege for personal gain through the local network, in the paper, we present a distributed intrusion detection system named APA (Application Process Audit), which tackles the interior violation. APA provides a multi-agents system to set up tailored intrusion detection systems for real-time applications. Data mining technologies have been applied to the alerts file and audit logs in order to find some interesting audit rules, at the same time the rules base can be automatically extend with these rules. The whole system has six kinds of agent, which cooperate with each other to implement the monitor. Now APA has been applied to several security departments and has received a good reputation.