Agent-based Distributed Cooperative Intrusion Detection System

Abstract

Most of intrusion detection systems nowadays are not really distributed systems which cannot detect the distributed or cooperative attacks effectively. In this paper, an agent-based distributed cooperative model (ADCM) is proposed, which implements cooperative intrusion detection through efficient, normative event messages exchange among logic detection domains (LDD). Some specific detection agents are also presented which are independent separately, while they can communicate and cooperate with one another to take actions. The ADCM improves the ability of error tolerance and cooperation without degradation of efficiency. Prototype of a distributed intrusion detection system based on ADCM and the extended intrusion detection message exchange format is completed, which proves to be powerful as expected in detecting intrusions.