Publication details
High-Performance Agent System for Intrusion Detection in Backbone Networks
| Authors | |
|---|---|
| Year of publication | 2007 |
| Type | Article in Proceedings |
| Conference | Cooperative Information Agents XI |
| MU Faculty or unit | |
| Citation | |
| web | http://www.springerlink.com/content/ng70434304xm0398/ |
| Field | Informatics |
| Keywords | high-speed network; agent system; intrusion detection; backbone network; |
| Description | This paper presents a design of high-performance agent-based intrusion detection system designed for deployment on high-speed network links. To match the speed requirements, wire-speed data acquisition layer is based on hardware-accelerated NetFlow like probe, which provides overview of current network traffic. The data is then processed by detection agents that use heterogenous anomaly detection methods. These methods are correlated by means of trust and reputation models, and the conclusions regarding the maliciousness of individual network flows is presented to the operator via one or more analysis agents, that automatically gather supplementary information about the potentially malicious traffic from remote data sources such as DNS, whois or router configurations. Presented system is designed to help the network operators efficiently identify malicious flows by automating most of the surveillance process. |
| Related projects: |