Multi-agent Intrusion Detection System Research Articles

A Multi-Agent Intrusion Detection System Optimized by a Deep Reinforcement Learning Approach with a Dataset Enlarged Using a Generative Model to Reduce the Bias Effect

Intrusion detection systems can defectively perform when they are adjusted with datasets that are unbalanced in terms of attack data and non-attack data. Most datasets contain more non-attack data than attack data, and this circumstance can introduce biases in intrusion detection systems, making them vulnerable to cyberattacks. As an approach to remedy this issue, we considered the Conditional Tabular Generative Adversarial Network (CTGAN), with its hyperparameters optimized using the tree-structured Parzen estimator (TPE), to balance an insider threat tabular dataset called the CMU-CERT, which is formed by discrete-value and continuous-value columns. We showed through this method that the mean absolute errors between the probability mass functions (PMFs) of the actual data and the PMFs of the data generated using the CTGAN can be relatively small. Then, from the optimized CTGAN, we generated synthetic insider threat data and combined them with the actual ones to balance the original dataset. We used the resulting dataset for an intrusion detection system implemented with the Adversarial Environment Reinforcement Learning (AE-RL) algorithm in a multi-agent framework formed by an attacker and a defender. We showed that the performance of detecting intrusions using the framework of the CTGAN and the AE-RL is significantly improved with respect to the case where the dataset is not balanced, giving an F1-score of 0.7617.

Design Methodology For The Development Of A Multi-Agent Intrusion Detection System For Countering Distributed Denial Of Service (Ddos) Attacks In Mobile Ad-Hoc Networks.

The proliferation of wireless mobile devices has revolutionized the world, leading to the popularity of the mobile ad hoc networking technology [1]. This emergence of the mobile ad hoc network (MANET) has facilitated the drift from personal computing to ubiquitous computing in our society. Today, mobile devices such as smartphones, laptops, notebooks and tablets are fast becoming an integral part of man’s life and a good number of those in the academia and industry now access the Internet on-the-go, through a wide range of mobile devices. In this paper, we provide our design methodology for the development of a multi-agent intrusion detection system for countering distributed denial of service (DDOS) attacks in mobile ad-hoc networks. Keywords: DDOS, Mult-agent intrusion detection, security, MANET, Attacks.

DMAIDPS: a distributed multi-agent intrusion detection and prevention system for cloud IoT environments

DMAIDPS: a distributed multi-agent intrusion detection and prevention system for cloud IoT environments

Multi Agent Based Intrusion Detection System using Artificial Immune System for Distributed Network

To enhance the ability of intrusion detection system (IDS) with detection accuracy and low false positive rate, artificial immune system (AIS) based multi agent IDS is proposed that is inspired by human immune system (HIS). Presented IDS is designed four new algorithms these are mobile agent cloning algorithm, attribute selection algorithm based on danger theory which is filtering unnecessary attributes and giving most appropriate attributes for intrusion detection, detection algorithm based on negative selection technique is the prime algorithm which is detecting intrusions and rule algorithm is the simple and initial level algorithm to find normality or abnormality in the captured packet. Proposed IDS is the combination of misuse and anomaly IDS where architecture is the client server cum distributed IDS architecture. Proposed IDS reducing work load of network administrator and overcome network latency through automation and dynamic adaptation of mobile agent which is implement clonal selection concept of AIS. Proposed IDS is increasing efficiency and detection accuracy by using negative selection concept of AIS to design rule agent and informative agent. Another concept of AIS is danger theory is used to design packet capture & extract packet agent which is support to reduce execution time and improve efficiency. Database agent is used to maintain or update database (training, testing) dynamically during novel information identified. Finally alert agent responded to client host after intrusion detected for further action. These entire agents are the primary and most influential performer of the proposed IDS. Presented IDS identify and focused on most appropriate 13 attributes out of 41 of a packet to detect intrusion and proved that intrusion detection accuracy and intrusion detection rate increased with 0.2% and 0.1% respectively and reduce false positive rate with 0.5%.

Analysis of KDD CUP Dataset Using Multi-Agent Methodology with Effective Fuzzy Based Intrusion Detection System

ABSTRACTSecure environment construction against the several intrusions is an attractive research area in Wireless Sensor Network (WSN) and Mobile Ad-hoc Network (MANET)-based real-time applications. Intrusion Detection System (IDS) evolved in network research studies improves the security and protects the resources from the various intrusions. The centralized and the distributed IDS are the major IDS categories. The central point failure in centralized IDS under heavy load introduces the security issues. The centralized system deficiency and hierarchical nature introduces the agent-based IDS. This article proposes the Multi-Agent IDS to detect the packet transmission failures and anomaly behavior in two different datasets namely KDD cup 1999 and the real-time traffic dataset. The Multi-Agent Based IDS (MAIDS) employs the distance and density-based algorithms for cluster formation. The rules formation in either association or sequential manner detects and classifies the attacks to the respective agent. Finally, the fuzzy-rules formulation in MAIDS predicts the intrusion type. The comparative analysis between the MAIDS and Network Intrusion Detection System (NIDS) regarding latency, overhead, and packet delivery ratio conveys that the MAIDS provided the better performance than the NIDS.

MAM-ISSIDS: multi-agent model-based intelligent and self-sharing intrusion detection system for distributed network

Intrusion detection system (IDS) is essential for protecting the computer networks from various threats and attacks. The autonomous multi-agent model (MAM) architecture is a scalable and smart alternative to leverage the strengths of the host and network based IDS. This paper proposes MAM-based intelligent and self-sharing IDS (MAM-ISSIDS) for distributed network to detect the host, network and web service attacks. Feature selection is performed by using the integrated particle swarm optimisation-genetic algorithm (PSO-GA) approach. The intuitionistic fuzzy rules are used to formulate the rules of the existing attackers for the benchmark dataset. The ontology structure is used to share the rules in network. The MAM is used for detecting the occurrence of abnormal traffic resulting due to the intrusion attacks. The proposed system achieves higher attack detection rate, accuracy and lower false positive rate due to the distributed sharing strategy of the MAM.

A Fusion of Multiagent Functionalities for Effective Intrusion Detection System

Provision of high security is one of the active research areas in the network applications. The failure in the centralized system based on the attacks provides less protection. Besides, the lack of update of new attacks arrival leads to the minimum accuracy of detection. The major focus of this paper is to improve the detection performance through the adaptive update of attacking information to the database. We propose an Adaptive Rule-Based Multiagent Intrusion Detection System (ARMA-IDS) to detect the anomalies in the real-time datasets such as KDD and SCADA. Besides, the feedback loop provides the necessary update of attacks in the database that leads to the improvement in the detection accuracy. The combination of the rules and responsibilities for multiagents effectively detects the anomaly behavior, misuse of response, or relay reports of gas/water pipeline data in KDD and SCADA, respectively. The comparative analysis of the proposed ARMA-IDS with the various existing path mining methods, namely, random forest, JRip, a combination of AdaBoost/JRip, and common path mining on the SCADA dataset conveys that the effectiveness of the proposed ARMA-IDS in the real-time fault monitoring. Moreover, the proposed ARMA-IDS offers the higher detection rate in the SCADA and KDD cup 1999 datasets.

Study of Computer Security Based on Biological Immune

In this paper, the multi-agent computer virus immune system based on immunity and multi-agent intrusion detection system based on immunity are established thorough combination of biological immune system and multi-agent technology. The multilayer defense structure is applied to the computer virus immune system to realize high distributives, adaptively and robustness relying on the independent agents with different functions. As for the intrusion detection system, the acquired knowledge is automatically systemized in the way of gene combination to cope with some unknown attack modes, moreover, the system is able to collect data in the different layers and analyze the essential relationship, so that it can detect not only the host-based attack, but also the network-based attack.

A new ontology‐based multi agent framework for intrusion detection

SummaryOntologies play an essential role in knowledge sharing and exploration, especially in multiagent systems. Intrusion is an unauthorized activity in a network, which is achieved by either active manner (information gathering) or passive manner (harmful packet forwarding). Most of the existing intrusion detection system (IDS) suffers from the following issues: it is usually adjusted to detect known service level network attacks and leaves from vulnerable to original and novel malicious attacks. Thus, it provides low accuracy and detection rate, which are the important problems of existing IDS. To overwhelm these drawbacks, an ontology‐based multiagent IDS framework is developed in this work for intrusion detection. The main intention of this work is to detect the network attacks with the help of multiple detection agents. In this analysis, there are 3 different types of agents, ie, IDS broker, deputy commander, and response agent, which are used to prevent and detect the attacks in a network. The novel concept of this work is based on the concept of signature matching; it identifies and detects the attackers with the help of multiple agents.

OMAMIDS: Ontology Based Multi-Agent Model Intrusion Detection System for Detecting Web Service Attacks

ABATRACTWeb service plays a significant role in the Internet applications. According to the current researchers, the web services are highly prone to the cyber-attacks. The Intrusion Detection System (IDS) is developed to detect these attacks. The main drawback of the traditional IDSs is the usage of some specific language, to define the rules. To overcome the drawback, a self-learning ontology is used to update the rules according to the new types of attacks. This paper presents an Ontology-based Multi-Agent Model Intrusion Detection System (OMAMIDS) for detecting web service attacks. The attacker rules are generated using the Intuitionistic Fuzzy Logic (IFL). The sniffing agent is used to monitor the network behavior and an analysis agent is used to select the set of required information from the sniffed data. It detects the behavior of the request, whether it is normal or abnormal. If the behavior is normal, request processing is enabled. Otherwise, the packet is forwarded to the decision agent. The decision agent includes globally shared rules of the attacker, for taking actions related to the severity level of the detected attack. The proposed system achieves high detection rate and accuracy and lower false positive rate than the existing techniques.

Multi-agent Intrusion Detection and Prevention System for Cloud Environment

computing is a type of distributed computing approach for IT Sector that leverages in efficient pooling of on-demand, self-managed virtual Infrastructures consuming them as a service by applications/organizations which would save thousands of dollars on CapEx and OpEx. To adopt this new cloud technology main concern for the consumers is the cloud computing security and it is the responsibility for the service providers to secure the cloud make it available at all time without interruption. In cloud computing all resources are virtualized by Hypervisor by creating Virtual machines, but its vulnerabilities raises many questions relating to security due to intrusion of malwares which allows security breaches. In this paper we propose Multi-Agent Intrusion Detection and Prevention System(MA-IDPS) by using Agents which will prevent security breach in Cloud due to attacks from intruder malware programs. Our system will be deployed at every instance of VM as well as at the client node end to detect and prevent intrusions due to malicious programs by an IDPS agents. This MA-IDPS model not only protects the cloud environment but also secures its agents and encrypts data tables that are part of IDPS by placing them in secure environment like Agent Runtime Environment (ARE) and Root VM respectively.MA-IDPS agent reports or prevents any abnormal behavior to Cloud administrator for further action. The proposed model secures the cloud from outside attacks either from client side or by a malware programs created in VMs

Co-operative Wireless Intrusion Detection System Using MIBs From SNMP

In emerging technology of Internet, security issues are becoming more challenging. In case of wired LAN it is somewhat in control, but in case of wireless networks due to exponential growth in attacks, it has made difficult to detect such security loopholes. Wireless network security is being addressed using firewalls, encryption techniques and wired IDS (Intrusion Detection System) methods. But the approaches which were used in wired network were not successful in producing effective results for wireless networks. It is so because of features of wireless network such as open medium, dynamic changing topology, cooperative algorithms, lack of centralized monitoring and management point, and lack of a clear line of defense etc. So, there is need for new approach which will efficiently detect intrusion in wireless network. Efficiency can be achieved by implementing distributive, co-operative based, multi-agent IDS. The proposed system supports all these three features. It includes mobile agents for intrusion detection which uses SNMP (Simple network Management Protocol) and MIB (Management Information Base) variables for mobile wireless networks.

Distributed and cooperative multi-agent based intrusion detection system

One of the primary challenges in intrusion detection is modeling typical application behavior, so that we can recognize attacks by their atypical effects without raising too many false alarms. IDS implemented using mobile agents is one of the new paradigms for intrusion detection. In this paper, we have proposed an effective intrusion detection system in which local agent collects data from its own system and it classifies anomaly behaviors using SVM classifier. Each local agent is capable of removing the host system from the network on successful detection of attacks. The mobile agent gathers information from the local agent before it allows the system to send data. Our system identifies successful attacks from the anomaly behaviors. Experimental results show that the proposed system has high detection rate and low false alarm rate which encourages the proposed system.

A Snort-based agent for a JADE multi-agent intrusion detection system

We describe the design of a misuse detection agent, one of the distinct agents in a multi-agent-based intrusion detection system. This system is being implemented in JADE, a well-known multi-agent platform based in Java. The agent analyses the packets in the network connections using a packet sniffer and then creates a data model based on the information obtained. This data model is the input to a rule-based inference engine agent, which uses the Rete algorithm for pattern matching and the rules of the signature-based intrusion detection system, Snort. Specifically, an implementation in Java language – the Drools-JBoss Rules – was used and a parser was implemented that converts Snort rules into Drools rules. The use of object-oriented techniques, together with design patterns, means that the agent is flexible, easily configurable and extensible.

Attack Pattern Analysis Framework For Multiagent Intrusion Detection System

The paper proposes the use of attack pattern ontology and formal framework for network traffic anomalies detection within a distributed multiagent Intrusion Detection System architecture. Our framework assumes ontology-based attack definition and distributed processing scheme with exchange of communicates between agents. The role of traffic anomalies detection was presented then it has been discussed how some specific values characterizing network communication can be used to detect network anomalies caused by security incidents (worm attack, virus spreading). Finally, it has been defined how to use the proposed techniques in distributed IDS using attack pattern ontology.

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

A cooperative agent-based model for active security systems

This paper presents a multi-agent model for implementing active security concepts. In this model, a group of agents can carry out their tasks cooperatively in order to achieve an ultimate security goal. Thus a low-level module of the proposed model reads the values of interesting data items of the relevant current network events and passes them to a relational database. Comparing these measurements against predefined values in an intruder signature database may point to a particular attack. The proposed model consists of two parts. (1) A multiagent Intrusion Detection System (MIDS) for detecting attacks. (2) An Active Security Mechanism (ASM) for taking active, network-wide, response against attackers. The proposed approach provides a customizable host environment built from various systems software components to allow an optimal match between the intrusion circumstances and the underlying security architecture. Thus, different frameworks can support alternative responses of existing security services. In addition, the ASM can take rapid response against attacks by making use of sensible sharing of attack intelligence. System agents communicate with each other on different hosts using an agent communication language through a message router.

Lightweight agents for intrusion detection

We have designed and implemented an intrusion detection system (IDS) prototype based on mobile agents. Our agents travel between monitored systems in a network of distributed systems, obtain information from data cleaning agents, classify and correlate information, and report the information to a user interface and database via mediators. Agent systems with lightweight agent support allow runtime addition of new capabilities to agents. We describe the design of our Multi-agent IDS and show how lightweight agent capabilities allowed us to add communication and collaboration capabilities to the mobile agents in our IDS.