High-Performance Agent System for Intrusion Detection in Backbone Networks

Abstract. This paper presents a design of high-performance agentbased intrusion detection system designed for deployment on high-speed network links. To match the speed requirements, wire-speed data acquisition layer is based on hardware-accelerated NetFlow like probe, which provides overview of current network traffic. The data is then processed by detection agents that use heterogenous anomaly detection methods. These methods are correlated by means of trust and reputation models, and the conclusions regarding the maliciousness of individual network flows is presented to the operator via one or more analysis agents, that automatically gather supplementary information about the potentially malicious traffic from remote data sources such as DNS, whois or router configurations. Presented system is designed to help the network operators efficiently identify malicious flows by automating most of the surveillance process.

• Type: Conference
• Year: 2007
• Where: CIA
• Authors: Martin Rehák, Michal Pechoucek, Pavel Celeda, Vojtech Krmicek, Jirí Moninec, Tomás Dymácek, David Medvigy
• Keywords: Agentbased Intrusion Detection, Artificial Intelligence, CIA 2007, Current Network Traffic, Heterogenous Anomaly Detection