Poster: SMURFEN: a rule sharing collaborative intrusion detection network

  • Authors:
  • Carol Fung;Quanyan Zhu;Raouf Boutaba;Tamer Basar

  • Affiliations:
  • University of Waterloo, Waterloo, ON, Canada;University of Illinois at Urbana-Champaign, Urbana, IL, USA;University of Waterloo, Waterloo, ON, Canada;University of Illinois at Urbana-Champaign, Urbana, IL, USA

  • Venue:
  • Proceedings of the 18th ACM conference on Computer and communications security
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

Intrusion Detection Systems (IDSs) are designed to monitor network traffic and computer activities in order to alert users about suspicious intrusions. Collaboration among IDSs allows users to benefit from the collective knowledge and information from their collaborators and achieve more accurate intrusion detection. However, most existing collaborative intrusion detection networks rely on the exchange of intrusion data which raises privacy concerns. To overcome this problem, we propose SMURFEN: a knowledge-based intrusion detection network, which provides a platform for IDS users to effectively share their customized detection knowledge in an IDS community. An automatic knowledge propagation mechanism is proposed based on a decentralized two-level optimization problem formulation, leading to a Nash equilibrium solution which is proved to be scalable, incentive compatible, fair, efficient and robust.