Decentralized Detector Generation in Cooperative Intrusion Detection Systems

We consider Cooperative Intrusion Detection System (CIDS) which is a distributed AIS-based (Artificial Immune System) IDS where nodes collaborate over a peer-to-peer overlay network. The AIS uses the negative selection algorithm for the selection of detectors (e.g., vectors of features such as CPU utilization, memory usage and network activity). For better detection performance, selection of all possible detectors for a node is desirable but it may not be feasible due to storage and computational overheads. Limiting the number of detectors on the other hand comes with the danger of missing attacks. We present a scheme for the controlled and decentralized division of detector sets where each IDS is assigned to a region of the feature space. We investigate the trade-off between scalability and robustness of detector sets. We address the problem of self-organization in CIDS so that each node generates a distinct set of the detectors to maximize the coverage of the feature space while pa...

• Type: Conference
• Year: 2007
• Where: SSS
• Authors: Rainer Bye, Katja Luther, Seyit Ahmet Çamtepe, Tansu Alpcan, Sahin Albayrak, Bülent Yener
• Keywords: Detector Sets, Detectors, Feature Space, SSS 2007