Adaptive agents applied to intrusion detection

Authors:
Javier Carbó;Agustín Orfila;Arturo Ribagorda
Affiliations:
Carlos III University of Madrid, Computer Science Department, Leganés, Madrid, Spain;Carlos III University of Madrid, Computer Science Department, Leganés, Madrid, Spain;Carlos III University of Madrid, Computer Science Department, Leganés, Madrid, Spain
Venue:
CEEMAS'03 Proceedings of the 3rd Central and Eastern European conference on Multi-agent systems
Year:
2003

Citing 7
Cited 2

Agents that reduce work and information overload

Communications of the ACM
A calculus for mass assignments in evidential reasoning

Advances in the Dempster-Shafer theory of evidence
Testing and evaluating computer intrusion detection systems

Communications of the ACM
The base-rate fallacy and its implications for the difficulty of intrusion detection

CCS '99 Proceedings of the 6th ACM conference on Computer and communications security
A fuzzy model of reputation in multi-agent systems

Proceedings of the fifth international conference on Autonomous agents
An Intrusion Detection System for Aglets

MA '02 Proceedings of the 6th International Conference on Mobile Agents
An Architecture for Intrusion Detection Using Autonomous Agents

ACSAC '98 Proceedings of the 14th Annual Computer Security Applications Conference

Multi-agent framework in visual sensor networks

EURASIP Journal on Applied Signal Processing
Learning from others: Exchange of classification rules in intelligent distributed systems

Artificial Intelligence

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper proposes a system of agents that make predictions over the presence of intrusions. Some of the agents act as predictors implementing a given Intrusion Detection model, sniffing out the same traffic. An assessment agent weights the forecasts of such predictor agents, giving a final binary conclusion using a probabilistic model. These weights are continuously adapted according to the previous performance of each predictor agent. Other agent establishes if the prediction from the assessor agent was right or not, sending him back the results. This process is continually repeated and runs without human interaction. The effectiveness of our proposal is measured with the usual method applied in Intrusion Detection domain: Receiver Operating Characteristic curves (detection rate versus false alarm rate). Results of the adaptive agents applied to intrusion detection improve ROC curves as it is shown in this paper.