MONI: Mobile Agents Ontology based for Network Intrusions Management

A Multi-agents Intrusion Detection System Using Ontology and Clustering Techniques

“…Through the carried out experiments, we have to stress on evaluating the performance of our system in terms of (i ) the scalability-related criteria such as network bandwidth, detection delay and system response time; and (ii ) the detection ability. During the evaluations, we compare the results of the OCMAS-IDS system vs. that of the centralized IDS Snort [17] and the multi-agents based ontology one MONI 8 [7]. All experiments were carried out on equivalent machines equipped with a 3GHz Pentium IV and 8GB of main memory.…”

“…In [7], Djotio et al proposed a MONI system based on an ontology model, called NIM-COM. The MONI system includes a multi-agents IDS to achieve a distribution of the detection activities.…”

“…They can be used as basic components to perform automatic and continuous analysis based on high-level policy defined to detect threats and attacks [10]. Moreover, they enable the IDS with improved capacity to reason over and analyze instances of data representing an intrusion [7,20]. Furthermore, the interoperability property of the ontologies is essential to adapt to the problems of the systems distribution, since the cooperation between various information systems is supported [3,7].…”

“…Moreover, they enable the IDS with improved capacity to reason over and analyze instances of data representing an intrusion [7,20]. Furthermore, the interoperability property of the ontologies is essential to adapt to the problems of the systems distribution, since the cooperation between various information systems is supported [3,7]. Within the OCMAS-IDS system, an ontology, called ASO (Attack Signatures based Ontology), is implemented, in order to optimize the knowledge representation and to incorporate more intelligence in the information analysis.…”

“…Therefore, multi-agent technology makes the resilience of the system strong and thus ensures its safety [6] Alongside, the concept of ontology has emerged as a powerful method for domain knowledge representation and sharing. It can improve the intrusion detection features giving the ability to share a common conceptual understanding threats and design the signature rules [1,7,10,13,20]. In fact, the use of the ontologies and OWL (Ontology Web Language) within the intrusion detection context has different advantages: (i) Grasping the semantic knowledge about the intrusion detection subject; (ii) Expressing the IDS much more by building better rules of signatures using the SWRL (Semantic Web Rule Language) [9]; and (iii) Making intelligent reasoning [6,10].…”