A Distributed Intrusion Detection System with Protection from an Internal Intruder

Shterenberg, S. I.; Poltavtseva, Maria A.

doi:10.3103/s0146411618080230

Cited by 16 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Further classification of the IDS is based on how these components are connected and coordinated in the system. Thus, there are monolithic, distributed, hierarchical, and agent-based systems [43,44]. The distributed IDS assumes that each node of the information system has its own IDS which are able to communicate with each other, and there is one dedicated IDS server that is responsible for the final data analysis and decision-making.…”

Section: Intrusion Detection Systemsmentioning

confidence: 99%

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

2022

View full text Add to dashboard Cite

In order to provide an accurate and timely response to different types of the attacks, intrusion and anomaly detection systems collect and analyze a lot of data that may include personal and other sensitive data. These systems could be considered a source of privacy-aware risks. Application of the federated learning paradigm for training attack and anomaly detection models may significantly decrease such risks as the data generated locally are not transferred to any party, and training is performed mainly locally on data sources. Another benefit of the usage of federated learning for intrusion detection is its ability to support collaboration between entities that could not share their dataset for confidential or other reasons. While this approach is able to overcome the aforementioned challenges it is rather new and not well-researched. The challenges and research questions appear while using it to implement analytical systems. In this paper, the authors review existing solutions for intrusion and anomaly detection based on the federated learning, and study their advantages as well as open challenges still facing them. The paper analyzes the architecture of the proposed intrusion detection systems and the approaches used to model data partition across the clients. The paper ends with discussion and formulation of the open challenges.

show abstract

Section: Intrusion Detection Systemsmentioning

confidence: 99%

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

2022

View full text Add to dashboard Cite

show abstract

“…), Application -applications running on devices. The implementation of scanners from each of the sources allowed us to create a solution that collects the following user behavior features [44][45][46].…”

Section: Model Structurementioning

confidence: 99%

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

Kotenko

Krasov

Ushakov

et al. 2021

JSAN

View full text Add to dashboard Cite

One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated.

show abstract

“…Big data classical techniques are traditionally referred to as the field of endto-end or request-response solutions. While intrusion detection systems require online analysis, they use methods of data-flow computing of incoming data [56].…”

Section: Distributed Intrusion Detections Systems In Big Datamentioning

confidence: 99%

Distributed Intrusion Detection Systems in Big Data: A Survey

Hameed

AlHabshy

ElDahshan

2021

Al-Azhar Bulletin of Science

View full text Add to dashboard Cite

We live in a time where data stream by the second, which makes intrusion detection a more difficult and tiresome task, and in turn intrusion detection systems require an efficient and improved detection mechanism to detect the intrusive activities. Moreover, handling the size, complexity, and availability of big data requires techniques that can create beneficial knowledge from huge streams of the information, which imposes the challenges on the process of both designing and management of both Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) in terms of performance, sustainability, security, reliability, privacy, energy consumption, fault tolerance, scalability, and flexibility. IDSs and IPSs utilize various methodologies to guarantee security, accessibility and reliability of enterprise computer networks. This paper presents a comprehensive study of the Distributed Intrusion Detection Systems in Big Data, and presents intrusion detection and prevention techniques that utilize machine learning, big data analytics techniques in distributed systems of the intrusion detection.

show abstract

A Distributed Intrusion Detection System with Protection from an Internal Intruder

Cited by 16 publications

References 9 publications

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

Distributed Intrusion Detection Systems in Big Data: A Survey

Contact Info

Product

Resources

About