Abstract
This paper describes the rule propagation model for the misuse detection methods using mobile agents. Approaches to detecting intrusions can be broadly classified into two categories: Anomaly Detection and Misuse Detection. Misuse detection is best suited for reliably detecting known use patterns. Misuse detection systems can detect many or all known attack patterns, but they are of little use for as yet unknown attack methods [1]. Therefore, the introduction of mobile agents to provide computational security by constantly moving around the Internet and propagating rules is presented as a solution to misuse detection. This work presents a method of use of mobile agent mechanisms to add mobility features to the process of rule propagation. This approach presents significant advantages in terms of spreading rules rapidly, increasing scalability and providing fault tolerance.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
R. G. Bace. Intrusion Detection, Macmillan Technical Publishing 2000.
B. Mukherjee, T. L. Heberlein and K. N. Levitt. Network Intrusion Detection. IEEE Network, May/June 1994.
R. Jagannathan, T. Lunt, D. Anderson, C. Dodd, F. Gilham, C. Jalali, H. Javitz, P. Neumann, A. Tamaru, and A. Valdes. System Design Document: Next-Generation Intrusion Detection Expert System (NIDES). Technical Report A007/A008/A009/ A011/A012/A014, SRI International, March 1993.
S. Kumar and E. Spafford. “A Pattern Matching Model for Misuse Intrusion Detection,” Proceedings of the Seventeenth National Computer Security Conference, Oct. 1994.
Information Security 21c, the history and kinds of intrusion detection system, http://www.securityinformation.com, July 2001.
U. Lindqvist and P. A. Porras. Detecting computer and network misuse through the Production-Based Expert System Toolset (PBEST). In Proceedings of the 1999 Symposium on Security and Privacy, Oakland, California, May 1999.
H. S. Nwana. Software Agents: an Overview. Knowledge Engineering Review, 1996.
M. Crosbie and G. H. Spafford. Defending a Computer System using Autonomous Agents. Technical Report No. 95-022, Dept. of Comp. Sciences, Purdue University, March 1996.
M. Crosbie, and E. H. Spafford. “Active Defense of a Computer System using Autonomous Agents”, Technical Report CSD-TR-95-008, Department of Computer Sciences, Purdue University, 1995.
Balasubramaniyan, Jai, J. O. Garcia-Fernandez, E. H. Spafford, and D. Zamboni. An Architecture for Intrusion Detection using Autonomous Agents. Department of Computer Sciences, Purdue University; Coast TR 98-05; 1998.
S. Stolfo, A. Prodromidis, S. Tselepsis, W. Lee, D. Fan and P. Chan. JAM: Java Agents for Metalearning over Distributed Databases. In Prod. Third Intl. Conf. Knowledge Discovery and Data Mining, 1997.
G. G. Helmer, J. S. K. Wong, V. Honavar, and L. Miller. Intelligent agents for intrusion detection. In Proceedings, IEEE Information Technology Conference, pages 121–124, Syracuse, NY, September 1998.
A. Porras and P. G. Neumann. EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In Proceedings of the National Information Systems Security Conference, Oct 1997.
A. Porras and A. Valdes. “Live Traffic Analysis of TCP/IP Gateways,” in Networks and Distributed Systems Security Symposium, March 1998.
B. Jai, J. O. Garcia-Fernandez, E. H. Spafford, and D. Zamboni. An Architecture for Intrusion Detection using Autonomous Agents. Department of Computer Sciences, Purdue University; Coast TR 98-05; 1998.
K. Boudaoud, H. Labiod, R. Boutaba, Z. Guessoum. Network security management with intelligent agents. Network Operations and Management Symposium, 2000. NOMS 2000.
L. Qi, L. Yu. “Mobile agent-based security model for distributed system”, Systems, Man, and Cybernetics, 2001 IEEE International Conference, 2001.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2002 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, TK., Lee, DY., Chung, T.M. (2002). Mobile Agent-Based Misuse Intrusion Detection Rule Propagation Model for Distributed System. In: Shafazand, H., Tjoa, A.M. (eds) EurAsia-ICT 2002: Information and Communication Technology. EurAsia-ICT 2002. Lecture Notes in Computer Science, vol 2510. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-36087-5_97
Download citation
DOI: https://doi.org/10.1007/3-540-36087-5_97
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-00028-0
Online ISBN: 978-3-540-36087-2
eBook Packages: Springer Book Archive