Agent Methods for Network Intrusion Detection and Response

  • Authors:
  • Martin Rehák;Michal Pĕchouček;David Medvigy;Magda Prokopová;Jan Tožička;Lukáš Foltýn

  • Affiliations:
  • Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic;Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic;Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic;Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic;Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic;Department of Cybernetics, Czech Technical University in Prague, Technická 2, Prague 6, 166 27, Czech Republic

  • Venue:
  • HoloMAS '07 Proceedings of the 3rd international conference on Industrial Applications of Holonic and Multi-Agent Systems: Holonic and Multi-Agent Systems for Manufacturing
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

While the need to build the Intrusion Detection Systems (IDS) based on on a distributed and cooperative (P2P) paradigm is being generally acknowledged, the field has been disconnected from the recent advances in the multi-agent research, most notably the field of trust modeling. Our contribution reviews recent implementations of IDS systems and presents them from an agent research perspective. We also identify the opportunities where the agent approaches can be successfully used. Agent techniques can make the IDS more adaptive, scalable and reliable while increasing their autonomy and reducing the maintenance requirements. Besides trust modeling, we propose that the distributed decision-making and planning techniques can be used to shorten the detection-response loop, making the system more robust while facing worm attacks.