Abstract-We present a cooperative intrusion detection approach inspired by biological immune system principles and P2P communication techniques to develop a distributed anomaly detection scheme. We utilize dynamic collaboration between individual artificial immune system (AIS) agents to address the well-known false positive problem in anomaly detection . The AIS agents use a set of detectors obtained through negative selection during a training phase and exchange status information and detectors on a periodical and event-driven basis, respectively. This cooperation scheme follows peer-to-peer communication principles in order to avoid a single point of failure and increase the robustness of the system. We illustrate our approach by means of two specific example scenarios in a novel network security simulator.

Abstract. The two new compounds Er3OFS3 and Er3OF3S2 vary mostly in their fluoride and sulfide content. The fluoride-poor erbium(III) oxide fluoride sulfide Er3OFS3 crystallizes in the tetragonal space group I4/mmm (a = 374.86(2), c = 2068.41(9) pm, Z = 2) with two crystallographically different Er 3+ cations. (Er1) 3+ is surrounded by six S 2-anions in the shape of a slightly distorted octahedron, whereas (Er2) 3+ exhibits a coordination number of eight (4 × O 2-/F -and 4 × S 2-arranged as a square antiprism). In the crystal structure of Er3OFS3 edge-sharing tetrahedral [ZEr4] 10.5+ units (Z n-= 50% O 2-+ 50% F -) form condensed 2 ∞ [OFEr2] 3+ layers. These layers alternate with 2 ∞ [ErS3] 3-sheets, built up of [ErS6] 9-octahedra, which are connected via four common edges, to complete the three-dimensional crystal structure of Er3OFS3. The fluoride-rich erbium(III) oxide fluoride sulfide Er3OF3S2 crystallizes in the orthorhombic space group Ccce (a = 538.31(2), b = 1892.03(9), c = 538.27(2) pm, Z = 4). Two crystallographically distinct Er 3+ cations are present in its crystal structure. (Er1) 3+ is surrounded by eight Z n-anions (Z = 25% O 2-+ 75% F -) in the shape of a twisted square antiprism, while (Er2) 3+ holds a coordination number of nine (4 × O 2-/F -and 5 × S 2-arranged as a monocapped square antiprism), copying the coordination geometry of the Er 3+ cations in PbFCl-type ErFS. The threedimensional structure of Er3OF3S2 is built up of S 2-sheets and 2 ∞ [OF3Er3] 4+ double layers, which are formed by strongly contorted tetrahedral [ZEr4] 10.75+ units (Z n-= 25% O 2-+ 75% F -). The crystals of this compound show a prominent superstructure in the tetragonal space group I4/mmm with a = 380.59(3), c = 1892.03(9) pm and Z = 2. In the crystal structures of both title compounds, the light anions O 2-and F -occupy one crystallographically unique Wyckoff position in a statistic allocation. Subject to the O/F content in the formulae, the ratio of O 2-: F -is 1 : 1 in Er3OFS3 and 1 : 3 in Er3OF3S2.

In the field of intrusion detection systems, the aspect of anomaly detection is very important, and consequently there are many approaches that address these security issues. The usage of Self-Organizing Map (SOM) makes a foundation for some of these approaches, which consequently often have problems to cope with the requirements of huge nowadays networks. The proposed approach focuses on improving the usage of SOMs for anomaly detection, by combining the strengths of different SOM algorithms. The performed evaluations have shown the necessity of paying attention to different aspects, coming along with network nodes, to individually choose the best matching SOM for each node's anomaly detection.

No abstract