New Collaborative Intrusion Detection Architecture Based on Multi Agent Systems

Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

A New Approach In Learning For Intelligent Multi Agent Systems

A critical issue in patient planning is to determine whether the medical processes of a patient can be completed by a time constraint based on the available resources in hospitals. The problem is a Temporal Constraint Satisfaction Problem (TCSP). The objectives of this paper are to propose a viable and systematic approach to develop a distributed cooperative problem solver for TCSP and estimate the shortest and the longest completion time for handling a patient in the presence of uncertainty based on Multi-agent systems (MAS) architecture. Our approach combines MAS with a subclass of time Petri net (TPN) models to solve TCSP. Existing analysis methods of TPN based on state classes cannot be applied directly due to distributed architecture of MAS. In this paper, a temporal analysis method based on MAS architecture is proposed. Our temporal analysis method efficiently deduces the earliest and latest completion time of a patient based on interaction between agents.

This chapter addresses the problem of interoperability among intrusion detection systems. It presents a classification and a brief description of intrusion detection systems, taking into account several issues such as information sources, analysis of intrusion detection systems, response options for intrusion detection systems, analysis timing, control strategy, and architecture of intrusion detection systems. It is also discussed the problem of information exchange among intrusion detection systems, being addressed the intrusion detection exchange protocol and a format for the exchange of information among intrusion detection systems, called by intrusion detection message exchange format. The lack of a format of the answers or countermeasures interchanged between the components of intrusion detection systems is also discussed as well as some future trends in this area.

Fixture design is a complex and intuitive process which is largely experience based. Expert system techniques have been used to capture the design knowledge which can be used in automating the design process. The bottle-neck in such a process is the difficulty in acquiring the knowledge of the experienced designer. Case-Based Reasoning (CBR) techniques function effectively in such domains where the design knowledge is sparse or unknown. This paper reports the use of CBR for automatic retrieval of fixture designs and modifications to suit the requirements of the present situation. A CAD model of a part is given as an input to the system. A feature recognizer developed is used to extract the machining features represented in the CAD model. For each generated set-up, suitable fixture-cases from the case-base are retrieved and modified using the design strategies. Relevant case-representation methodology, indexing strategies, retrieval symptoms and modification strategies used for the automated design of modular fixtures are also explained.

A use of case-based reasoning technique in building expert systems

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

Developing A Multi-Agent System in JADE for Information Management in Educational Competence Domains

This chapter addresses the problem of interoperability among intrusion detection systems. It presents a classification and a brief description of intrusion detection systems, taking into account several issues such as information sources, analysis of intrusion detection systems, response options for intrusion detection systems, analysis timing, control strategy, and architecture of intrusion detection systems. It is also discussed the problem of information exchange among intrusion detection systems, being addressed the intrusion detection exchange protocol and a format for the exchange of information among intrusion detection systems, called by intrusion detection message exchange format. The lack of a format of the answers or countermeasures interchanged between the components of intrusion detection systems is also discussed as well as some future trends in this area.

Wireless intrusion detection systems are an important addition to the security of wireless local area networks (WLANs). We focus on intrusion detection and security consideration in wireless local area networks. We present intrusion detection for WLANs, give wireless intrusion detection systems and system architecture considerations. We also present a conceptual model for an IDS agent. IDS agents can cooperatively participate in global intrusion detection actions. These individual IDS agents collectively form the IDS system to protect the mobile wireless network. Meanwhile, we introduce some infrastructures as elements of wireless IDS for WLANs.

Intrusion detection systems play an important role in preventing attacks which have been increased rapidly due to the dependence on network and Internet connectivity. Deep learning algorithms are promising techniques, which have been used in many classification problems. In the same way, multi-agent systems become a new useful approach in intrusion detection field. In this paper, we propose a deep learning-based multi-agent system for intrusion detection which combines the desired features of multi-agent system approach with the precision of deep learning algorithms. Therefore, we created a number of autonomous, intelligent and adaptive agents that implanted three algorithms, namely autoencoder, multilayer perceptron and k-nearest neighbors. Autoencoder is used as features reduction tool, and multilayer perceptron and k-nearest neighbors are used as classifiers. The performance of our model is compared against traditional machine learning approaches and other multi-agent system-based systems. The experiments have shown that our hybrid distributed intrusion detection system achieves the detection with better accuracy rate and it reduces considerably the time of detection.

This chapter is the second chapter in Part II of the book. It is also the basis for Chapter 9, as shown in the shaded area of Fig. 7.1. This chapter first examines the relationship between case-based reasoning (CBR) systems and multiagent systems (MASs), and proposes knowledge-based models of multiagent CBR systems from both logical and knowledge-based viewpoints. Then this chapter investigates the case base and case retrieval in a distributed setting and examines the integration of case-based reasoning capabilities in a BDI architecture. This chapter also discusses CBR for agent team cooperation. Finally this chapter proposes an agent architecture using CBR to model an agent negotiation strategy.

Multi-Agent Systems (MASs) and Case-Based Reasoning (CBR) are two recent and hot paradigms in artificial intelligence field. CBR is a reasoning methodology based on old experience reasoning or similarity-based reasoning while MAS is a new paradigm to organize AI applications. CBR offers multi-agent systems the capability of autonomously learning from experience. This study examines the integration of CBR, MASs and Expert Systems (ESs). In addition, it presents a knowledge-based model of multi-agent CBR systems from both a logical and a knowledge-based viewpoint.

This article deals with the proposal of distributed parallel network system architecture for intrusion detection. The aim is to design model of architecture that will be used for searching, detecting and analyzing intrusions. This proposal of detection system in network will use enormous performance of the GPGPU high-parallel data computing technology which can substitute the most complicated part of the intrusion detection process in NIDS. The model is highly scalable and allows the usage of several most recent trends in the IDS field with GPGPU support. Due to the fast attacks reaction system analyzes all the data in different formats in whole set of attacks and system alerts.

Metamorphic virus employs code obfuscation techniques to mutate itself. It absconds from signaturebased detection system by modifying internal structure without compromising original functionality. In this paper, we propose a new method, for detecting metamorphic computer viruses, that is based on the technique of Case-Based Reasoning (CBR). In this method: -Can detect similar viruses with high probability. - The updating of the virus database is done automatically without connecting to the Internet. Whenever a new virus is detected, it will be automatically added to the database used by our application. This presents a major advantage.