Distributed and Scalable Intrusion Detection System Based on Agents and Intelligent Techniques
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
The Internet explosion and the increase in crucial web applications such as e-banking and e-commerce, make essential the need for network security tools. One of such tools is an Intrusion detection system which can be classified based on detection approachs as being signature-based or anomaly-based. Even though intrusion detection systems are well defined, their cooperation with each other to detect attacks needs to be addressed. Consequently, a new architecture that allows them to cooperate in detecting attacks is proposed. The architecture uses Software Agents to provide scalability and distributability. It works in two modes: learning and detection. During learning mode, it generates a profile for each individual system using a fuzzy data mining algorithm. During detection mode, each system uses the FuzzyJess to match network traffic against its profile. The architecture was tested against a standard data set produced by MIT's Lincoln Laboratory and the primary results show its efficiency and capability to detect attacks. Finally, two new methods, the memory-window and memoryless-window, were developed for extracting useful parameters from raw packets. The parameters are used as detection metrics.
Abstract
The Internet explosion and the increase in crucial web applications such as e-banking and e-commerce, make essential the need for network security tools. One of such tools is an Intrusion detection system which can be classified based on detection approachs as being signature-based or anomaly-based. Even though intrusion detection systems are well defined, their cooperation with each other to detect attacks needs to be addressed. Consequently, a new architecture that allows them to cooperate in detecting attacks is proposed. The architecture uses Software Agents to provide scalability and distributability. It works in two modes: learning and detection. During learning mode, it generates a profile for each individual system using a fuzzy data mining algorithm. During detection mode, each system uses the FuzzyJess to match network traffic against its profile. The architecture was tested against a standard data set produced by MIT's Lincoln Laboratory and the primary results show its efficiency and capability to detect attacks. Finally, two new methods, the memory-window and memoryless-window, were developed for extracting useful parameters from raw packets. The parameters are used as detection metrics.
참고문헌 (22)
- Computer security threat monitoring and surveillance, "J. Anderson", Anderson Company, ~ (1980)
- D. Denning, "An intrusion detection model", IEEE Transactions on Software Engineering, 13(2), pp.222~232 (1987)
- Next-generation intrusion detection expert system (NIDES), "D. Anderson", SRI International, Computer Science Laboratory, ~, pp.Technical Report SRI-CSL-95-07 (1995)
- M. Roesch, "Snort−lightweight intrusion detection for networks", In Proceedings of the 13th Systems Administration Conference, pp.229~238 (1999)
- K. Ilgun, "State transition analysis: A rule-based Intrusion detection approach", IEEE Transactions on Software Engineering, 21(3), pp.181~199 (1995)
- Software architecture to support misuse intrusion detection, "S. Kumar", Department of Computer Science, Purdue University, ~ (1995)
- T. Lane, "Machine Learning Techniques for Computer Security", 박사, pp.2000
- W. Lee, "Data mining approaches for intrusion detection", In Proceedings of the 7th USENIX Security Symposium (1998)
- W. Lee, "A data mining framework for building intrusion detection model", In Proceedings of the IEEE Symposium on Security and Privacy (1999)
- J. E. Dickerson, "Fuzzy network profiling for intrusion detection", In Proceedings of the North American Fuzzy Information Processing Society, pp.301~306 (2000)
- J. E. Dickerson, "Fuzzy intrusion detection", In Pro-ceedings of North American Fuzzy Information Processing Society 2001 (2001)
- G. Florez, "An improved algorithm for fuzzy data mining for intrusion detection", In North American Fuzzy Information Processing Society Conference (NAFIPS 2002) (2002)
- Aly El-Semary, "Framework for hybrid fuzzy logic intrusion detection systems", In Proceedings of the 2005 IEEE International Conference on Fuzzy Systems, pp.325~330 (2005)
- Aly El-Semary, "Implementation of a hybrid intrusion detection system using FuzzyJess", In Proceedings of the 7th International Conference on Enterprise Information Systems, pp.390~393 (2005)
- Aly El-Semary, "Applying data mining of fuzzy association rules to network intrusion detection", In Proceedings of the 7th Annual IEEE Information Assurance Workshop, pp.100~107, United States Military Academy, West Point
- J. Luo, "Mining fuzzy association rules and fuzzy frequency episodes for intrusion detection", International Journal of Intelligent Systems, 15(8), pp.687~703 (2000)
- M. Qin, "Frequent episode rules for intrusive anomaly detection With Internet data mining", n Proceedings of the 13th USENIX Security Symposium (2004)
- S. Bridges, "Fuzzy data mining and genetic algorithms applied to intrusion detection", In Proceedings of the 23rd National Information Systems Security Conference (2000)
- Ming-Yang Su, "Discovery and prevention of attack episodes by frequent episodes mining and finite state machines", Journal of Network and Computer Applications, 33(2), pp.156~167 (2010)
- "The FuzzyJess toolkit"[URL]
- "The C Language Integrated Production System (CLIPS)"[URL]
- "DARPA Intrusion Detection Data Set"[URL]