Combining Immune Systems and Social Insect Metaphors: a Paradigm for Distributed Intrusion Detection and Response Systems

Abstract : Given the ongoing evolution and broadening of network environments, one should reconsider computer security from a new point of view. Indeed, the increasing transparency of network connections is a wide open door to new kinds of distributed attacks exploiting, among others, the inherent flaws of TCP/IP. In this paper, we advocate that future Intrusion Detection and Response Systems (IDRS) should exhibit characteristics adapted to such environments. Thus, we propose an architecture of distributed IDRS inspired by natural systems. On the one side, the detection process mimics the functioning of natural immune systems: it monitors crucial computer processes and computes a deviation value allowing to discriminate between “normal" and “abnormaly" behavior. A strong deviation is regarded as the sign of a possible attack. A population of mobile agents, the Intrusion Detection Agents (IDAs), which are sensitive to this deviation, are responsible for the detection of the corresponding suspicious activity. On the other side, the alert raising and response processes are based on communication mechanisms present in social insect colonies: an artificial communication medium called “artificial pheromone" is used to build alert gradients (mapped over the network and originating from threatened machines). A population of mobile agents, the Intrusion Response Agents (IRAs), sensitive to these pheromones, react to these alert gradients by implementing a distributed response process. We present the overview and principles of our architecture, as well as a detailed description of its intrinsic components. We describe some of our simulation work dealing with parameter analysis which was previously achieved. In the present paper, we discuss in greater details some new results.
Type de document :
Article dans une revue
Lecture Notes in Computer Science, LNCS, 2003, 2881, pp.251-264. 〈10.1007/978-3-540-39646-8_24〉
Liste complète des métadonnées

https://hal.archives-ouvertes.fr/hal-01593378
Contributeur : Équipe Gestionnaire Des Publications Si Liris <>
Soumis le : mardi 26 septembre 2017 - 10:48:40
Dernière modification le : jeudi 19 avril 2018 - 14:38:03

Identifiants

Citation

Noria Foukia, Salima Hassas, Serge Fenet, Paul Albuquerque. Combining Immune Systems and Social Insect Metaphors: a Paradigm for Distributed Intrusion Detection and Response Systems. Lecture Notes in Computer Science, LNCS, 2003, 2881, pp.251-264. 〈10.1007/978-3-540-39646-8_24〉. 〈hal-01593378〉

Partager

Métriques

Consultations de la notice

126