FACID: A trust-based collaborative decision framework for intrusion detection networks

Abstract

Computer systems evolve to be more complex and vulnerable. Cyber attacks have also grown to be more sophisticated and harder to detect. Intrusion detection is the process of monitoring and identifying unauthorized system access or manipulation. It becomes increasingly difficult for a single intrusion detection system (IDS) to detect all attacks due to limited knowledge about attacks. Collaboration among intrusion detection devices can be used to gain higher detection accuracy and cost efficiency as compared to its traditional single host-based counterpart. Through cooperation, a local IDS can detect new attacks that may be known to other IDSs, which may be from different vendors. However, how to utilize the diagnosis from different IDSs to perform intrusion detection is the key challenge. This paper proposes a system architecture of a collaborative intrusion detection network (CIDN), in which trustworthy and efficient feedback aggregation is a key component. To achieve a reliable and trustworthy CIDN, we present a framework called FACID, which leverages data analytical models and hypothesis testing methods for efficient, distributed and sequential feedback aggregations. FACID provides an inherent trust evaluation mechanism and reduces communication overhead needed for IDSs as well as the computational resources and memory needed to achieve satisfactory feedback aggregation results when the number of collaborators of an IDS is large. Our simulation results corroborate our theoretical results and demonstrate the properties of cost efficiency and accuracy compared to other heuristic methods. The analytical result on the lower-bound of the average number of acquaintances for consultation is essential for the design and configuration of IDSs in a collaborative environment.

Counselors network for intrusion detection

“…Samples for both benign and malicious activities are extracted from the CICIDS2017 dataset. 23 This scenario is similar to the collaborative IDS proposed by Fung and Zhu, 20 except for the analyzed attacks and features.…”

“…Finally, Fung and Zhu 20 propose a collaborative IDS, which deploys IDSs in different parts of the network. IDSs with different specialties or training datasets can consult each other.…”

A trust-based game theoretical model for cooperative intrusion detection in multi-cloud environments

“…It became significantly more difficult for a traditional single intrusion detection system, whether it is network-based, hypervisor-based, or VM-based, to detect all attacks, due to limited knowledge about attacks. Collaboration among intrusion detection systems (IDSs) can be exploited to gain higher detection accuracy as compared to traditional single IDS [1]. Through collaboration, IDSs in different regions, and possibly, belonging to different Cloud Providers (CPs) can cooperate in such a way that makes them utilize the expertise of each other to cover and identify unknown attack patterns.…”

“…Moreover, they do not need a database of known attacks. However, the shortcoming of using anomalybased detection is the relative high false positive rate compared to the signature-based technique [1]. IDSs may adopt both techniques to have improved detection accuracy.…”

“…However, the detection accuracy is limited by the amount of knowledge they have (e.g., their security vendors have). Recent research [1] [3] shows that the collaborative detection can enhance the detection rate up to 60%. Through collaboration, an IDS can benefit from other IDSs expertise by consulting them about suspicious behavior.…”