A Proposed Multi-Agent System for Intrusion Detection System in a Complex Network

Abstract

The openness of business toward telecommunication network in general and internet in particular is performed at the prize of high security risks. Every professional knows that the only way to secure completely a private network is to make it unreachable. However, even if this solution was undertaken for many years, nowadays it is not possible to close private network especially for business purpose. Thus security management becomes an important issue that must be considered carefully.This research concentrates on one particular aspect. where the networks becomes more complex (number of machines, number of users, number of connections....), making them more vulnerable to various kinds of complex security attacks. Therefore the Intrusion Detection Systems (IDSs) require more advanced models to deal with these requirements. Multi-Agent System (MAS) is suggested to provide powerful for the modeling and development of complex systems for detecting attacks. This can be done by depending on decomposition ofthe system into several interacting and autonomous entities called agents. Agent is an entity functions continuously an autonomously in an environment in which other processes take place and other agents exist.

Using Multi-Agent Systems for Intrusion Detection in Computer Networks: A Glance

“…Hamami et al [1] have presented the MAS for intrusion detection in complex networks (networks with many users, machines, and connections). The researchers' perspective of proposed IDS present that MAS is an appropriate solution for intrusion detection considering its various properties like distribution, cooperation etc.…”

Network Security Management Using Ontology-Based Mobile Agents

“…Also, it may learn or use knowledge to achieve these goals. A hierarchal architecture of the SA-NSM is proposed and studied by [5,18] based on a multi-agent system. It is viewed as a collection of autonomous and intelligent agents located in specific network entities named NSM hosts.…”

“…But, in practice, it is not possible to have a completely secure network. So, applying security management is a two-fold activity: 1-The security architecture is to be deployed to protect networks by detecting attack; and 2-when attacks are detected the security architecture deals with these attacks in real time by taking security measures [5] . An efficient management system is needed to make use of different security mechanisms in large networks.…”