Architecture Of Distributed Intrusion Detection System Research Articles

Fog-Driven Approach for Distributed Intrusion Detection System in Auditing the Data Dased on Blockchain-Cloud Systems

Intrusion detection is a familiar phrase in the information and network security domain. An Intrusion Detection System (IDS) is a device or software that will keep track of the networks, for unlawful movements, and policy breaches that arise within the network. There are different forms of IDS, Host Intrusion Detection System (HIDS) helps in identifying unauthorized activities on the host, Network Intrusion Detection System (NIDS) helps in identifying attacks in the network, whereas Distributed Intrusion Detection System (DIDS) consists of multiple IDS over a large area of network where individual IDS communicates with each other or with the central the authorized central server. The proposed work has a three-layered architecture for DIDS for securing data sharing among different IDS. The bottom layer uses multiple IDS, the fog layer is supported with Blockchain functionality, and the cloud service at the upper layer stores required data permanently for future analysis. The fog computing-based architecture for DIDS tries to implement the application in a scalable and trustless environment using distributed ledger technology. The evaluation of the proposed work is carried out for fog, cloud, and integrated fog-cloud with the Blockchain functionality and without Blockchain functionality in measuring performance metrics related to throughput, service latency, response time, block creation time, and block execution time.

Multi Agent Based Intrusion Detection System using Artificial Immune System for Distributed Network

To enhance the ability of intrusion detection system (IDS) with detection accuracy and low false positive rate, artificial immune system (AIS) based multi agent IDS is proposed that is inspired by human immune system (HIS). Presented IDS is designed four new algorithms these are mobile agent cloning algorithm, attribute selection algorithm based on danger theory which is filtering unnecessary attributes and giving most appropriate attributes for intrusion detection, detection algorithm based on negative selection technique is the prime algorithm which is detecting intrusions and rule algorithm is the simple and initial level algorithm to find normality or abnormality in the captured packet. Proposed IDS is the combination of misuse and anomaly IDS where architecture is the client server cum distributed IDS architecture. Proposed IDS reducing work load of network administrator and overcome network latency through automation and dynamic adaptation of mobile agent which is implement clonal selection concept of AIS. Proposed IDS is increasing efficiency and detection accuracy by using negative selection concept of AIS to design rule agent and informative agent. Another concept of AIS is danger theory is used to design packet capture & extract packet agent which is support to reduce execution time and improve efficiency. Database agent is used to maintain or update database (training, testing) dynamically during novel information identified. Finally alert agent responded to client host after intrusion detected for further action. These entire agents are the primary and most influential performer of the proposed IDS. Presented IDS identify and focused on most appropriate 13 attributes out of 41 of a packet to detect intrusion and proved that intrusion detection accuracy and intrusion detection rate increased with 0.2% and 0.1% respectively and reduce false positive rate with 0.5%.

An adaptive distributed Intrusion detection system architecture using multi agents

Intrusion detection systems are used for monitoring the network data, analyze them and find the intrusions if any. The major issues with these systems are the time taken for analysis, transfer of bulk data from one part of the network to another, high false positives and adaptability to the future threats. These issues are addressed here by devising a framework for intrusion detection. Here, various types of co-operating agents are distributed in the network for monitoring, analyzing, detecting and reporting. Analysis and detection agents are the mobile agents which are the primary detection modules for detecting intrusions. Their mobility eliminates the transfer of bulk data for processing. An algorithm named territory is proposed to avoid interference of one analysis agent with another one. A communication layout of the analysis and detection module with other modules is depicted. The inter-agent communication reduces the false positives significantly. It also facilitates the identification of distributed types of attacks. The co-ordinator agents log various events and summarize the activities in its network. It also communicates with co-ordinator agents of other networks. The system is highly scalable by increasing the number of various agents if needed. Centralized processing is avoided here to evade single point of failure. We created a prototype and the experiments done gave very promising results showing the effectiveness of the system.