Distributed and Scalable Intrusion Detection System Based on Agents and Intelligent Techniques

Abstract--The Internet explosion and the increase in crucial web applications such as ebanking and e-commerce, make essential the need for network security tools. One of such tools is an Intrusion detection system which can be classified based on detection approachs as being signature-based or anomaly-based. Even though intrusion detection systems are well defined, their cooperation with each other to detect attacks needs to be addressed. Consequently, a new architecture that allows them to cooperate in detecting attacks is proposed. The architecture uses Software Agents to provide scalability and distributability. It works in two modes: learning and detection. During learning mode, it generates a profile for each individual system using a fuzzy data mining algorithm. During detection mode, each system uses the FuzzyJess to match network traffic against its profile. The architecture was tested against a standard data set produced by MIT's Lincoln Laboratory and the primary results...

• Type: Journal
• Year: 2010
• Where: JIPS
• Authors: Aly M. El-Semary, Mostafa Gadal-Haqq M. Mostafa
• Keywords: Detection, Intrusion Detection Systems, JIPS 2010, Software Agents