TitleRandomly Roving Agents for Intrusion Detection
Publication TypeConference Paper
Year of Publication2001
AuthorsMoskowitz, I. S., M. Kang, LW. Chang, and G. E. Longdon
Conference Name15th IFIP WG 11.3 Working Conference on Database and Application Security
PublisherKluwer Press
Conference LocationNiagra on the Lake, Canada
Abstract

Agent based intrusion detection systems (IDS) have advantages such as scalability, reconfigurability, and survivability. In this paper, we introduce a mobile-agent based IDS, called ABIDE (Agent Based Intrusion Detection Environment). ABIDE is comprised of various types of agents, all of which are mobile, lightweight, and specialized. The most common form of agent is the DMA (Data Mining Agent), which randomly moves around the network and collects information. The DMA then relays the information it has gathered to a DFA (Data Fusion Agent) which assesses the likelihood of intrusion. As we show in this paper, there is a quantifiable relationship between the number of DMA and the probability of detecting an intrusion. We study this relationship and its implications.

Full Text

Moskowitz etal2001.pdf

NRL Publication Release Number

01-1221.1-0801