Distributed and Scalable Intrusion Detection System Based on Agents and Intelligent Techniques

Abstract

Abstract-The Internet explosion and the increase in crucial web applications such as ebanking and e-commerce, make essential the need for network security tools. One of such tools is an Intrusion detection system which can be classified based on detection approachs as being signature-based or anomaly-based. Even though intrusion detection systems are well defined, their cooperation with each other to detect attacks needs to be addressed. Consequently, a new architecture that allows them to cooperate in detecting attacks is proposed. The architecture uses Software Agents to provide scalability and distributability. It works in two modes: learning and detection. During learning mode, it generates a profile for each individual system using a fuzzy data mining algorithm. During detection mode, each system uses the FuzzyJess to match network traffic against its profile. The architecture was tested against a standard data set produced by MIT's Lincoln Laboratory and the primary results show its efficiency and capability to detect attacks. Finally, two new methods, the memory-window and memoryless-window, were developed for extracting useful parameters from raw packets. The parameters are used as detection metrics.

Detecting SYN flooding attacks based on traffic prediction

“…In addition, more simulation results and scenarios can be constructed while nodes leave and join the networks. It is helpful to develop a more effective SYN flooding mitigation scheme relying on other schemes such as SynDefender (http://www.checkpoint.com/products/rewall-1) to mitigate SYN flooding attacks for large‐scale network security or wireless network security in the future.…”

“…It is helpful to develop a more effective SYN flooding mitigation scheme relying on other schemes such as SynDefender (http://www. checkpoint.com/products/rewall-1) to mitigate SYN flooding attacks for large-scale network security [26] or wireless network security [27][28][29][30][31][32] in the future. A demonstration of the security comm.…”

Federated Learning for Internet of Things: A Comprehensive Survey

“…FL can meet this requirement by distributing AI/ML models to the local devices and using the computational capability of all clients such as routers for building a strong attack defense mechanism for better detection rate. To improve the scalability of intrusion detection, a line-speed and scalable FL approach is introduced in [85]. Each IoT device runs a binarized NN for packet classification at the line speed of nearby switches in a scalable manner, while preserving privacy of network traces.…”

Detection of botnets before activation: an enhanced honeypot system for intentional infection and behavioral observation of malware

“…Hence, they are very critical to Internet service providers (ISPs) who provide network services to their individual subscribers and enterprise users who lease network lines over converged network services . Such damaging attacks have shifted the role of ISPs from simply providing network service to actively protecting themselves and their customers from the attacks . To minimize the damage incurred by such attacks, ISPs are adopting various techniques for botnet detection.…”