Multi-agent Intrusion Detection Research Articles

A multi-agent intrusion detection model based on importance feature extraction

A multi-agent intrusion detection model based on importance feature extraction

A Multi-Agent Intrusion Detection System Optimized by a Deep Reinforcement Learning Approach with a Dataset Enlarged Using a Generative Model to Reduce the Bias Effect

Intrusion detection systems can defectively perform when they are adjusted with datasets that are unbalanced in terms of attack data and non-attack data. Most datasets contain more non-attack data than attack data, and this circumstance can introduce biases in intrusion detection systems, making them vulnerable to cyberattacks. As an approach to remedy this issue, we considered the Conditional Tabular Generative Adversarial Network (CTGAN), with its hyperparameters optimized using the tree-structured Parzen estimator (TPE), to balance an insider threat tabular dataset called the CMU-CERT, which is formed by discrete-value and continuous-value columns. We showed through this method that the mean absolute errors between the probability mass functions (PMFs) of the actual data and the PMFs of the data generated using the CTGAN can be relatively small. Then, from the optimized CTGAN, we generated synthetic insider threat data and combined them with the actual ones to balance the original dataset. We used the resulting dataset for an intrusion detection system implemented with the Adversarial Environment Reinforcement Learning (AE-RL) algorithm in a multi-agent framework formed by an attacker and a defender. We showed that the performance of detecting intrusions using the framework of the CTGAN and the AE-RL is significantly improved with respect to the case where the dataset is not balanced, giving an F1-score of 0.7617.

Design Methodology For The Development Of A Multi-Agent Intrusion Detection System For Countering Distributed Denial Of Service (Ddos) Attacks In Mobile Ad-Hoc Networks.

The proliferation of wireless mobile devices has revolutionized the world, leading to the popularity of the mobile ad hoc networking technology [1]. This emergence of the mobile ad hoc network (MANET) has facilitated the drift from personal computing to ubiquitous computing in our society. Today, mobile devices such as smartphones, laptops, notebooks and tablets are fast becoming an integral part of man’s life and a good number of those in the academia and industry now access the Internet on-the-go, through a wide range of mobile devices. In this paper, we provide our design methodology for the development of a multi-agent intrusion detection system for countering distributed denial of service (DDOS) attacks in mobile ad-hoc networks. Keywords: DDOS, Mult-agent intrusion detection, security, MANET, Attacks.

DMAIDPS: a distributed multi-agent intrusion detection and prevention system for cloud IoT environments

DMAIDPS: a distributed multi-agent intrusion detection and prevention system for cloud IoT environments

Attention based multi-agent intrusion detection systems using reinforcement learning

Designing an effective network intrusion system (IDS) is a challenging problem because of the emergence of a large number of novel attacks and heterogeneous network applications. The existing IDSs fail to adapt to the changing attack patterns and unseen attacks that lead to inaccurate detection of network vulnerabilities and system performance degradation. Therefore, there is a need to design robust, scalable, efficient, and adaptive IDS for networks. This paper presents a novel deep reinforcement learning-based IDS that employs Deep Q-Network logic in multiple distributed agents and uses attention mechanisms to efficiently detect and classify advanced network attacks. Our proposed multi-agent IDS is designed as a distributed attack detection platform where agents work in a coordinated manner to provide scalable, fault-tolerant, multi-view architecture guided security system. We have tested our model with extensive experimentation on two benchmark datasets: NSL-KDD and CICIDS2017. It shows improved performance in terms of higher accuracy, precision, recall, F1-Score, and low false-positive rate (FPR) in comparison to the state-of-the-art IDS works. On the other hand, many machine learning systems are found vulnerable to adversarial attacks. Thus, we evaluated our model’s robustness against a practical black-box adversarial attack and observed only a little degradation in performance. We integrated the concept of denoising autoencoder (DAE) with our model to further improve its robustness. Finally, we discuss the usability of our system in real-life applications against zero-day attack patterns.

A Systematic State-of-the-Art Analysis of Multi-Agent Intrusion Detection

Multi-agent architectures have been successful in attaining considerable attention among computer security researchers. This is so, because of their demonstrated capabilities such as autonomy, embedded intelligence, learning and self-growing knowledge-base, high scalability, fault tolerance, and automatic parallelism. These characteristics have made this technology a de facto standard for developing ambient security systems to meet the open and dynamic nature of today’s online communities. Although multi-agent architectures are increasingly studied in the area of computer security, there is still not enough empirical evidence on their performance in intrusions and attacks detection. The aim of this paper is to report the systematic literature review conducted in the context of specific research questions, to investigate multi-agent IDS architectures to highlight the issues that affect their performance in terms of detection accuracy and response time. We used pertinent keywords and terms to search and retrieve the most recent research studies, on multi-agent IDS architectures, from the major research databases and digital libraries such as SCOPUS, Springer, and IEEE Explore. The search processes resulted in a number of studies; among them, there were journal articles, book chapters, conference papers, dissertations, and theses. The obtained studies were assessed and filtered out, and finally, there were over 71 studies chosen to answer the research questions. The results of this study have shown that multi-agent architectures include several advantages that can help in the development of ambient IDS. However, it has been found that there are several issues in the current multi-agent IDS architectures that may degrade the accuracy and response time of intrusions and attacks detection. Based on our findings, the issues of multi-agent IDS architectures include limitations in the techniques, mechanisms, and schemes used for multi-agent IDS adaptation and learning, load balancing, scalability, fault-tolerance, and high communication overhead. It has also been found that new measurement metrics are required for evaluating multi-agent IDS architectures.

MAM-ISSIDS: multi-agent model-based intelligent and self-sharing intrusion detection system for distributed network

Intrusion detection system (IDS) is essential for protecting the computer networks from various threats and attacks. The autonomous multi-agent model (MAM) architecture is a scalable and smart alternative to leverage the strengths of the host and network based IDS. This paper proposes MAM-based intelligent and self-sharing IDS (MAM-ISSIDS) for distributed network to detect the host, network and web service attacks. Feature selection is performed by using the integrated particle swarm optimisation-genetic algorithm (PSO-GA) approach. The intuitionistic fuzzy rules are used to formulate the rules of the existing attackers for the benchmark dataset. The ontology structure is used to share the rules in network. The MAM is used for detecting the occurrence of abnormal traffic resulting due to the intrusion attacks. The proposed system achieves higher attack detection rate, accuracy and lower false positive rate due to the distributed sharing strategy of the MAM.

A Fusion of Multiagent Functionalities for Effective Intrusion Detection System

Provision of high security is one of the active research areas in the network applications. The failure in the centralized system based on the attacks provides less protection. Besides, the lack of update of new attacks arrival leads to the minimum accuracy of detection. The major focus of this paper is to improve the detection performance through the adaptive update of attacking information to the database. We propose an Adaptive Rule-Based Multiagent Intrusion Detection System (ARMA-IDS) to detect the anomalies in the real-time datasets such as KDD and SCADA. Besides, the feedback loop provides the necessary update of attacks in the database that leads to the improvement in the detection accuracy. The combination of the rules and responsibilities for multiagents effectively detects the anomaly behavior, misuse of response, or relay reports of gas/water pipeline data in KDD and SCADA, respectively. The comparative analysis of the proposed ARMA-IDS with the various existing path mining methods, namely, random forest, JRip, a combination of AdaBoost/JRip, and common path mining on the SCADA dataset conveys that the effectiveness of the proposed ARMA-IDS in the real-time fault monitoring. Moreover, the proposed ARMA-IDS offers the higher detection rate in the SCADA and KDD cup 1999 datasets.

Study of Computer Security Based on Biological Immune

In this paper, the multi-agent computer virus immune system based on immunity and multi-agent intrusion detection system based on immunity are established thorough combination of biological immune system and multi-agent technology. The multilayer defense structure is applied to the computer virus immune system to realize high distributives, adaptively and robustness relying on the independent agents with different functions. As for the intrusion detection system, the acquired knowledge is automatically systemized in the way of gene combination to cope with some unknown attack modes, moreover, the system is able to collect data in the different layers and analyze the essential relationship, so that it can detect not only the host-based attack, but also the network-based attack.

OMAMIDS: Ontology Based Multi-Agent Model Intrusion Detection System for Detecting Web Service Attacks

ABATRACTWeb service plays a significant role in the Internet applications. According to the current researchers, the web services are highly prone to the cyber-attacks. The Intrusion Detection System (IDS) is developed to detect these attacks. The main drawback of the traditional IDSs is the usage of some specific language, to define the rules. To overcome the drawback, a self-learning ontology is used to update the rules according to the new types of attacks. This paper presents an Ontology-based Multi-Agent Model Intrusion Detection System (OMAMIDS) for detecting web service attacks. The attacker rules are generated using the Intuitionistic Fuzzy Logic (IFL). The sniffing agent is used to monitor the network behavior and an analysis agent is used to select the set of required information from the sniffed data. It detects the behavior of the request, whether it is normal or abnormal. If the behavior is normal, request processing is enabled. Otherwise, the packet is forwarded to the decision agent. The decision agent includes globally shared rules of the attacker, for taking actions related to the severity level of the detected attack. The proposed system achieves high detection rate and accuracy and lower false positive rate than the existing techniques.

Multi-agent Intrusion Detection and Prevention System for Cloud Environment

computing is a type of distributed computing approach for IT Sector that leverages in efficient pooling of on-demand, self-managed virtual Infrastructures consuming them as a service by applications/organizations which would save thousands of dollars on CapEx and OpEx. To adopt this new cloud technology main concern for the consumers is the cloud computing security and it is the responsibility for the service providers to secure the cloud make it available at all time without interruption. In cloud computing all resources are virtualized by Hypervisor by creating Virtual machines, but its vulnerabilities raises many questions relating to security due to intrusion of malwares which allows security breaches. In this paper we propose Multi-Agent Intrusion Detection and Prevention System(MA-IDPS) by using Agents which will prevent security breach in Cloud due to attacks from intruder malware programs. Our system will be deployed at every instance of VM as well as at the client node end to detect and prevent intrusions due to malicious programs by an IDPS agents. This MA-IDPS model not only protects the cloud environment but also secures its agents and encrypts data tables that are part of IDPS by placing them in secure environment like Agent Runtime Environment (ARE) and Root VM respectively.MA-IDPS agent reports or prevents any abnormal behavior to Cloud administrator for further action. The proposed model secures the cloud from outside attacks either from client side or by a malware programs created in VMs

The Study and Simulation on Campus Network Intrusion Detection System

In this paper, the current intrusion detection systems are analyzed in the full study of the development trend of domestic and foreign country. According to the campus network can be divided into functional independence of the structural characteristics of the subnet, while taking full advantage of agent technology in the intrusion detection system technology, we have referenced to the agent technology and a variety of detection methods for the analysis and comparison, and have analyzed the existing distributed intrusion detection system ,we propose a monitoring and management center with a multi-agent intrusion detection model framework. This model uses a distributed architecture that combines network-and host-based intrusion detection method for intrusion detection.

A Temporal Logic Based Approach to Multi-Agent Intrusion Detection and Prevention

Collaborative systems research in the last decade have led to the development in several areas ranging from social computing, e-learning systems to management of complex computer networks. Intrusion Detection Systems (IDS) available today have a number of problems that limit their configurability, scalability or efficiency. An important shortcoming is that the existing architectures is built around a single entity that does most of the data collection and analysis. This work introduces a new architecture for intrusion detection and prevention based on multiple autonomous agents working collectively. We adopt a temporal logic approach to signature-based intrusion detection. We specify intrusion patterns as formulas in a monitorable logic called EAGLE. We also incorporate logics of knowledge into the agents. We implement a prototype tool, called MIDTL and use this tool to detect a variety of security attacks in large log-files provided by DARPA.

A Snort-based agent for a JADE multi-agent intrusion detection system

We describe the design of a misuse detection agent, one of the distinct agents in a multi-agent-based intrusion detection system. This system is being implemented in JADE, a well-known multi-agent platform based in Java. The agent analyses the packets in the network connections using a packet sniffer and then creates a data model based on the information obtained. This data model is the input to a rule-based inference engine agent, which uses the Rete algorithm for pattern matching and the rules of the signature-based intrusion detection system, Snort. Specifically, an implementation in Java language – the Drools-JBoss Rules – was used and a parser was implemented that converts Snort rules into Drools rules. The use of object-oriented techniques, together with design patterns, means that the agent is flexible, easily configurable and extensible.

Attack Pattern Analysis Framework For Multiagent Intrusion Detection System

The paper proposes the use of attack pattern ontology and formal framework for network traffic anomalies detection within a distributed multiagent Intrusion Detection System architecture. Our framework assumes ontology-based attack definition and distributed processing scheme with exchange of communicates between agents. The role of traffic anomalies detection was presented then it has been discussed how some specific values characterizing network communication can be used to detect network anomalies caused by security incidents (worm attack, virus spreading). Finally, it has been defined how to use the proposed techniques in distributed IDS using attack pattern ontology.

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

A cooperative agent-based model for active security systems

This paper presents a multi-agent model for implementing active security concepts. In this model, a group of agents can carry out their tasks cooperatively in order to achieve an ultimate security goal. Thus a low-level module of the proposed model reads the values of interesting data items of the relevant current network events and passes them to a relational database. Comparing these measurements against predefined values in an intruder signature database may point to a particular attack. The proposed model consists of two parts. (1) A multiagent Intrusion Detection System (MIDS) for detecting attacks. (2) An Active Security Mechanism (ASM) for taking active, network-wide, response against attackers. The proposed approach provides a customizable host environment built from various systems software components to allow an optimal match between the intrusion circumstances and the underlying security architecture. Thus, different frameworks can support alternative responses of existing security services. In addition, the ASM can take rapid response against attacks by making use of sensible sharing of attack intelligence. System agents communicate with each other on different hosts using an agent communication language through a message router.