An Intrusion Response Scheme: Tracking the alert source using a stigmergy paradigm

Today, the security community is in search of novel solutions to achieve e cient responses to intrusions. This is particularly needed because attackers intervene in an automated way, at computer speed. There also is a need to respond according to the nature of the detected attack. That is why Intrusion Detection Systems (ID Systems) and Intrusion Response Systems (IR Systems) have to cooperate and work in parallel. To this end, it is more e cient to design the IR System in function of the ID System. This paper describes an IR System based on Mobile Agents (MAs) distributed throughout the network. This IR System is strongly adjustable to its partner ID System, also based on MAs. Both the ID System and the IR System are designed in quite similar ways, since both are mappings of the behavior of natural systems. We present our approach to building these two systems based on natural life. We particularly stress the design of our IR System and present some simulations to demonstrate its e ciency.