APHIDS++: Evolution of A Programmable Hybrid Intrusion Detection System

Abstract

With the rapid growth of the Internet and the ever-increasing security problems associated with its popularity, the need for protection against unwanted intruders has become essential. Antivirus software, intrusion detection systems, spyware and malware detectors are some of the protection mechanisms available to users today. The diversity of these manifold systems suggests the need for a unifying managerial system, such as APHIDS (A Programmable Hybrid Intrusion Detection System), a mobile agent based IDS, which can correlate and coalesce preexisting security components. In this thesis we provide a description of improvements made to the initial APHIDS design, comprising the addition of an optional intelligent agent meant to improve the response of APHIDS in detecting VoIP (Voice over IP) and generic intrusions; and an XML implementation of our Agent Deployment and Correlation Script (ADCS), which is used to initialize the agent environment, allowing for flexible user modifications to control the deployment and invocation of mobile agents.

Agent‐based simulation of cooperative defence against botnets

“…A variety of frameworks and architectures for multiagent modelling and simulation of distributed complex systems have been developed, for example, shared plans theory , joint intentions theory and hybrid approach , while various software multiagent environments have been implemented. The approaches based on belief‐desire‐intention, distributed constraint optimization, distributed partially observable Markov decision problems, and auctions or game‐theoretic are emphasized to provide the optimal interaction of heterogeneous components.…”

“…Recently, a lot of prominent works implementing agent‐based approach to network security were published, for example Refs. . All these works show the advantages of using agents for network security in comparison with traditional technologies (centralized and hierarchical) including higher fault tolerance and robustness, flexibility, subversion resistance (cross‐verification, with each agent being checked periodically by several others), minimal overhead (on communication and load of the host system), better adaptability, scalability and dynamic reconfiguration, and possibility of graceful degradation of service.…”

Multiagent Systems for Network Intrusion Detection: A Review

“…APHIDS was subsequently upgraded, generating APHIDS++ [52] that introduces a two-level caching scheme:…”