Distributed Intrusion Detection System Research Articles

The Study and Simulation on Campus Network Intrusion Detection System

In this paper, the current intrusion detection systems are analyzed in the full study of the development trend of domestic and foreign country. According to the campus network can be divided into functional independence of the structural characteristics of the subnet, while taking full advantage of agent technology in the intrusion detection system technology, we have referenced to the agent technology and a variety of detection methods for the analysis and comparison, and have analyzed the existing distributed intrusion detection system ,we propose a monitoring and management center with a multi-agent intrusion detection model framework. This model uses a distributed architecture that combines network-and host-based intrusion detection method for intrusion detection.

Research on Distributed Intrusion Detection System Based on Mobile Agent

For the problems of traditional intrusion detection system, a distributed intrusion detection system based on mobile agent was designed. In this paper, the internal function of mobile agent was divided in architecture view, and the optimal agent migration algorithm was researched to facilitate the agent collaborative processing. The communication manner and interactive processes were applied in the design. Furthermore, the traditional Boyer-Moore (BM) algorithm was improved. The simulation results showed that the system could reduce the network load, shorten the waiting time of network. All these contributed on the improvement of the intrusion detection. Then, the dynamic adaption of the system could be implemented while false alarm rate and false negative rate would be reduced. Therefore, the system is suitable for large-scale heterogeneous network.

Self-Protected Mobile Agent Approach for DistributedIntrusion Detection System against DDoS Attacks

With the growing Information Systems and Network technologies, security threats over the systems have also become common. Providing a security mechanism to detect such threats has become an inevitable part of Information Systems. Distributed Denial of Service (DDoS) attack is one of the most common attacks which are done in a co-ordinated manner. Hence, we need a Distributed Intrusion Detection System to detect those attacks. We use mobile agents for the purpose of Intrusion Detection. However, these mobile agents are prone to attacks which may lead to the failure of the IDS as a whole. In this paper, we propose a system for distributed intrusion detection system against DDoS attacks. In our system, we propose two security architectures namely Isolated Trusted Environment SMADIDS and Integrated Trusted Environment SMADIDS based on the mechanism of reference clone to protect the mobile agent from being modified. We also incorporate the functionality of Protocol Analysis Method in combination with the traditional rule based IDS to enhance the Intrusion Detection and to reduce false alarm rate. From the results obtained, it was observed that the system proves to be better in its performance compared to other traditional Intrusion Detection Systems and is found to provide at most security to the Mobile Agents. Keywords-Distributed Intrusion Detection System, Selfprotected mobile agents, DDoS, Reference Clone, Protocol Analysis, Network Security

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

The advent of the smart grid promises to usher in an era that will bring intelligence, efficiency, and optimality to the power grid. Most of these changes will occur as an Internet-like communications network is superimposed on top of the current power grid using wireless mesh network technologies with the 802.15.4, 802.11, and WiMAX standards. Each of these will expose the power grid to cybersecurity threats. In order to address this issue, this work proposes a distributed intrusion detection system for smart grids (SGDIDS) by developing and deploying an intelligent module, the analyzing module (AM), in multiple layers of the smart grid. Multiple AMs will be embedded at each level of the smart grid-the home area networks (HANs), neighborhood area networks (NANs), and wide area networks (WANs)-where they will use the support vector machine (SVM) and artificial immune system (AIS) to detect and classify malicious data and possible cyberattacks. AMs at each level are trained using data that is relevant to their level and will also be able to communicate in order to improve detection. Simulation results demonstrate that this is a promising methodology for supporting the optimal communication routing and improving system security through the identification of malicious network traffic.

Towards an Integrated Intrusion Detection Monitoring in High Speed Networks

Problem statement: Security Management has become a critical aspect for large scale distributed systems. Particularly, recent Distributed Intrusion Detection Systems (DIDS) schemes in High Speed Networks (HSN) have raised new serious management problems and challenges. Increasing the effectiveness of IDS monitoring is primordial to satisfy the restrictive constraints in such large multi-domains environment for narrow context of HSN. Approach: We consider the intrusion detection monitoring as a two facets entity: one at local level (single domain) and another at the global one (multi-domains). Through the local level, evolution of single domain intrusion detection process (vulnerability data collection, alert generation and sensor configuration according to some improvement scenarios) can be monitored. The global level represents evolution of multi-domain intrusion detection process as well as the eventual security defending process through overall network (policy generation, load balancing operations and global alert correlation). Differentiating these two facets, leads to the design of a scalable intrusion detection management solution. Results: The effectiveness of DIDS management in HSN had been studied and an IDS scalable monitoring architecture for multi-domains had been proposed. Several scenarios of Snort IDS showed an improvement on the performance of real-time detection. An integration of a set of tools provided a convivial IDS monitoring platform. Conclusion: To satisfy the constraints of Intrusion detection process in term of real-time and efficiency in HSN we need to monitor efficiently the IDS process. In this context, the management framework outlined is more appropriate, convenient and efficient. The herein proposed architecture, the snort IDS improvement techniques and the integrated platform played a crucial role in improving of IDS real-time monitoring.

Network Intrusion Detection System Embedded on a Smart Sensor

This paper proposes a Network Intrusion Detection System (NIDS) embedded in a smart-sensor-inspired device under a service-oriented architecture (SOA) approach which is able to operate independently as an anomaly-based NIDS, or integrated transparently in a Distributed Intrusion Detection System (DIDS). The proposal is innovative because it combines the advantages of the smart sensor approach and the subsequent offering of the NIDS functionality as a service with the SOA use to achieve their integration with other DIDS components. The main goal of this paper is to reduce the huge volume of management tasks inherent to this type of network services, as well as facilitating the design of DIDS whose managing complexity could be restricted within well-defined margins. This paper also addresses the construction of a physical sensor prototype. This prototype was used to carry out the tests that has demonstrated the proposal's validity, providing detection and performance ratios similar to those of existing intrusion detection systems (IDS), but with the advantage of a zero-maintenance approach.

Online Intrusion Alert Aggregation with Generative Data Stream Modeling

Alert aggregation is an important subtask of intrusion detection. The goal is to identify and to cluster different alerts-produced by low-level intrusion detection systems, firewalls, etc.-belonging to a specific attack instance which has been initiated by an attacker at a certain point in time. Thus, meta-alerts can be generated for the clusters that contain all the relevant information whereas the amount of data (i.e., alerts) can be reduced substantially. Meta-alerts may then be the basis for reporting to security experts or for communication within a distributed intrusion detection system. We propose a novel technique for online alert aggregation which is based on a dynamic, probabilistic model of the current attack situation. Basically, it can be regarded as a data stream version of a maximum likelihood approach for the estimation of the model parameters. With three benchmark data sets, we demonstrate that it is possible to achieve reduction rates of up to 99.96 percent while the number of missing meta-alerts is extremely low. In addition, meta-alerts are generated with a delay of typically only a few seconds after observing the first alert belonging to a new attack instance.

Modeling a distributed intrusion detection system using collaborative building blocks

Developing complex distributed systems is a non-trivial task. It is even more difficult when the systems need to dynamically reconfigure the distributed functionalities or tasks. Not only do we need to deal with the application-specific functionalities that are intricate, but we also have to handle the complex logic of coordinating the distribution and relocation of tasks. In this paper, we model an intrusion detection system that distributes its analysis units to a number of hosts and assigns fine-grained analysis tasks to these hosts in order to cope with the rapid increase of audit data from today's IT systems. The system is further capable to react to overload situations and to shift tasks to other hosts. To develop this complex system, we apply the model-based engineering method SPACE. In particular, we show that the collaborative specification style of the method can significantly reduce the development effort. Also, the formal semantics of SPACE ensures the correctness of important design properties.

Research on Distributed Intrusion Detection System Model

The paper made an analysis of advantages of the distributed intrusion detection system surrounding the limitations of the traditional intrusion detection methods and then put forward a new model of the distributed intrusion detection system and designed all the functional modules.The model combines the based features and aberrant behavior and can prevent intrusion interacting with firewall by means of cooperation between host configuration and net layout.

Novel Architecture for Intrusion-Tolerant Distributed Intrusion Detection System using Packet Filter Firewall and State Transition Tables

Tremendous efforts have been taken over many years to secure the network against attacks; still attackers are successful with painful frequency. Experienced attackers try to disable the Intrusion Detection System (IDS) before launching attack. Therefore there should be some mechanism in IDS for uninterrupted detection of intrusion even though failure in IDS has occurred due to attacks. This paper presents the design and implementation of Novel Intrusion-Tolerant Distributed Intrusion Detection System using Packet Filter Firewall and State Transition Tables. Proposed architecture is immune to both, failure of IDS components and compromised IDS components. This architecture is capable of restricting the effect of network attacks like DoS, DDoS and Probing to a subset of network. Experimental results prove the usefulness and efficiency of this architecture.

Design and Simulation of a Tree-Based Intrusion Detection System against Denial of Service

Based on analysis of relative and absolute traffic anomalies a fully DIDS(Distributed Intrusion Detection System) is built to detect and respond flooding DoS(Denial of Service) in a specific network area, using traffic trees as data structure to store, execute, communicate and combine abnormal data. A single component settled in a network element is called Tree-Devices and all Tree-Devices construct a Tree-DIDS, a fully DIDS. Tree-Devices communicate with other devices in three ways and collaborate to detect attacks, by which communication cost is reduced. Fully architecture avoids the single point failure, while double anomalies help to warn earlier. The simulation results and performance analysis show that Tree-DIDS works effectively.

A Novel Approach For Protecting Exposed Intranet From Intrusions

This paper proposes a novel approach for protecting groups of computers in an intranet from malicious attacks. The proposed scheme uses a distributed intrusion detection system as the primary source of security mechanism along with micro-firewalls at the host level to enable dynamic policy update for the intranet as and when the threat pattern changes. The authentication mechanism used for authenticating the hosts along with the communication mechanism used for communicating the policy update to the hosts is presented.

Research on distributed intrusion detection system based on multi-living agent

In this paper, we propose a novel distributed intrusion detection system based on multi-living agent inspired by the research method of multi-living agent complex information system for improving the security of distributed intrusion detection system using mobile agent. The previous two-layer distributed intrusion detection system has been expanded into a three-layer structure, the new layer of which can monitor the livelihood of each detection agent and utilize the negotiation-coordination mechanism to adjust the working way of each agent for protecting the security of system. In this paper, we propose a quantitative analysis method of agent livelihood in distributed intrusion detection system and further present the design method of living agent. Finally, through the analysis of system working flow and the detection effect of distributed denial of service attack, we have shown that the security and stability of the novel distributed intrusion detection system is effectively enhanced and the agent can work normally in strict restraint strong countermeasure environment.

Distributed intrusion detection system for wireless sensor networks based on a reputation system coupled with kernel self-organizing maps

Security of sensor networks is a complicated task, mostly due to the limited resources of sensor units. The first line of defense, i.e. encryption and authentication, is useless if an attacker has entered the system, and it is also vulnerable to side

Data Acquisition Module Research and Implementation of Distributed Intrusion Detection System

This article first introduced the invasion and the concept of intrusion detection, and then described the data acquisition module in the Distributed Intrusion Detection. Finally, with a programming package intercepted, and through experiments to prove that good data packets intercepted.

Securing computerised models and data against integrity attacks

Many computerised systems use electronic models that get triggered when certain business conditions arise. Unauthorised triggering of such computerised models has been overlooked in the security literature. In this paper, we propose two frameworks to analyse the security of systems that have the data-triggering computerised model architecture. The frameworks help understand how to mitigate the cyber attacks that can be launched against the data-model systems, by modifying the computerised models or the data. We then propose a Deterministic Specification distributed intrusion Detection System (DSdIDS) to secure the data-triggering model systems from internal as well as external cyber threats.

Optimal monitoring system for a distributed intrusion detection system

Distributed intrusion detection systems, which consist of spatially distributed monitoring elements, may be applied to detect intrusions in a real-time manner based on the analysis of collected data. This article will present and discuss some selected aspects of the architecture and efficiency of detection systems. The first part considers intrusion detection capabilities as being dependent on different distributed computer communication system parameters. The aim of the second part is to present an idea of the hierarchical architecture of distributed intrusion detection systems, and to assess the quality of monitoring performed in the lower layer of the hierarchical architecture of a distributed intrusion detection system.

A distributed intrusion detection system for resource-constrained devices in ad-hoc networks

This paper describes the design and implementation of a two-stage intrusion detection system (IDS) for use with mobile ad-hoc networks. Our anomaly-based intrusion detection is provided by analyzing the context from the application-level interactions of networked nodes; each interaction corresponds to a specific function or behavior within the operational scenario of the network. A static set of behaviors is determined offline, and these behaviors are tracked dynamically during the operation of the network. During the first stage of the IDS, our detection strategy employs the analysis of global and local maxima in the probability density functions of the behaviors to isolate deviance at the granularity of a single node. This stage is used to capture the typical behavior of the network. The first stage also provides tuning and calibration for the second stage. During the second stage, a cross-correlative component is used to detect multiple threats simultaneously. Our approach distributes the IDS among all connected network nodes, allowing each node to identify potential threats individually. The combined result can detect deviant nodes in a scalable manner and can operate in the presence of a density of deviant nodes approaching 22%. Computational requirements are reduced to adapt optimally to embedded devices on an ad-hoc network.

ACO based Distributed Intrusion Detection System

Intrusion detection is a problem of great significance to protecting information systems security. An intruder may move between multiple nodes in the network to conceal the origin of attack. Distributed intrusion detection and prevention plays an increasingly important role in securing computer networks. To overcome the limitations of conventional intrusion detection systems, alerts are made in distributed intrusion detection system which are exchanged and correlated in a cooperative fashion. It is necessary to develop fast machine learning based intrusion detection algorithms with high detection rates and low false alarm rates, due to the variety of network behaviors and the rapid development of attack fashions. The system has to observe to trigger thousands of alerts per day, in which most are mistakenly triggered by the false identification. So it is difficult for the analyst to correctly identify alerts related to the attack. This paper presents an intelligent learning approach using Ant Colony Optimization (ACO) based distributed intrusion detection system to detect intrusions in the distributed network. The experimental results on the proposed system with the feature extraction algorithm is effective to detect the unseen intrusion attacks with high detection rate and recognize normal network traffic with low false alarm rate.

Intrusion detection in voice over IP environments

In this article, we present the design of an intrusion detection system for voice over IP (VoIP) networks. The first part of our work consists of a simple single- component intrusion detection system called Scidive. In the second part, we extend the design of Scidive and build a distributed and correlation-based intrusion detection system called Space Dive. We create several attack scenarios and evaluate the accuracy and efficiency of the system in the face of these attacks. To the best of our knowledge, this is the first comprehensive look at the problem of intrusion detection in VoIP systems. It includes treatment of the challenges faced due to the distributed nature of the system, the nature of the VoIP traffic, and the specific kinds of attacks at such systems.