AIDeM: Agent-Based Intrusion Detection Mechanism

Pinzón, Cristian; Navarro, Martí; Bajo, Javier

doi:10.1007/978-3-642-12433-4_41

Cited by 4 publications

(11 citation statements)

References 5 publications

(3 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The third component is the management and coordination component that used to configure, organize, and maintain the multi-agent IDS architecture. In some cases, this component is manually managed by an administrator [6], [11], [53], while, in other cases, it is self-managed [37]. In the dynamically adaptive structure, this component is responsible for all self-management tasks.…”

Section: ) the Computational Components Classificationmentioning

confidence: 99%

“…Third, in most of the proposed approaches, the management task of the multi-agent IDS architecture is centralized and manually achieved by an administrator who interacts with the system through a user interface (console) to accomplish the management tasks such as creating, adding, or deleting agents [11], [19].…”

Section: ) Agents and Tasks Distributionmentioning

confidence: 99%

“…To solve this situation, multiple analysis agents can divide the workload among them and process the data concurrently. There are several studies that use multiple analyzer agents with multiple analysis techniques to balance the load and benefit from multiple analyzers [11], [67], [68]. The grouping of the data analysis methods and their advantages and disadvantages are explained in Appendix C.…”

Section: ) Data Analysismentioning

confidence: 99%

“…The manager agent performs management tasks either manually or automatically by using a self-management mechanism. In the case of manual management, an administrator is in charge of performing all the management operations such as adding, removing, and configuring architecture agents [11], [19]. The disadvantage of this method is that the IDS architecture is completely un-configurable and un-scalable without an administrator.…”

Section: ) Management and Coordinationmentioning

confidence: 99%

“…For protecting computer networks, Intrusion Detection System (IDS) is used to detect intrusions and attacks in realtime by analyzing network activities using statistics [2]- [4], rules [5]- [8] or machine learning [9]- [11]. IDS can be hostbased, network-based, or hybrid.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Systematic State-of-the-Art Analysis of Multi-Agent Intrusion Detection

et al. 2020

View full text Add to dashboard Cite

Multi-agent architectures have been successful in attaining considerable attention among computer security researchers. This is so, because of their demonstrated capabilities such as autonomy, embedded intelligence, learning and self-growing knowledge-base, high scalability, fault tolerance, and automatic parallelism. These characteristics have made this technology a de facto standard for developing ambient security systems to meet the open and dynamic nature of today's online communities. Although multi-agent architectures are increasingly studied in the area of computer security, there is still not enough empirical evidence on their performance in intrusions and attacks detection. The aim of this paper is to report the systematic literature review conducted in the context of specific research questions, to investigate multi-agent IDS architectures to highlight the issues that affect their performance in terms of detection accuracy and response time. We used pertinent keywords and terms to search and retrieve the most recent research studies, on multi-agent IDS architectures, from the major research databases and digital libraries such as SCOPUS, Springer, and IEEE Explore. The search processes resulted in a number of studies; among them, there were journal articles, book chapters, conference papers, dissertations, and theses. The obtained studies were assessed and filtered out, and finally, there were over 71 studies chosen to answer the research questions. The results of this study have shown that multi-agent architectures include several advantages that can help in the development of ambient IDS. However, it has been found that there are several issues in the current multi-agent IDS architectures that may degrade the accuracy and response time of intrusions and attacks detection. Based on our findings, the issues of multi-agent IDS architectures include limitations in the techniques, mechanisms, and schemes used for multi-agent IDS adaptation and learning, load balancing, scalability, fault-tolerance, and high communication overhead. It has also been found that new measurement metrics are required for evaluating multi-agent IDS architectures.

show abstract

Section: ) the Computational Components Classificationmentioning

confidence: 99%

Section: ) Agents and Tasks Distributionmentioning

confidence: 99%