A P2P intrusion detection system based on mobile agents

Traditional intrusion detection systems have a central coordinator with a static hierarchical architecture. We propose a peer-to-peer intrusion detection system that has no central coordinator. Our approach is like that of a “neighborhood watch”. A virtual neighborhood is created where neighbors take on the task of looking out for each other. When an intrusion occurs they observe this intrusion and inform the residents about this intrusion and collectively take action. We use cooperating, mobile agents for intrusion detection. Each site periodically sends mobile agents to visit and check up on its neighbors and report back. When inconsistent or anomalous behavior is observed, the observerneighbor initiates a voting process to take action against the compromised site. General Terms Security Keywords Intrusion detection, mobile agents

• Type: Conference
• Year: 2004
• Where: ACMSE
• Authors: Geetha Ramachandran, Delbert Hart
• Keywords: ACMSE 2004, Intrusion Detection, Intrusion Detection System, Theoretical Computer Science, Traditional Intrusion Detection