Abstract:Now days, diﬁerent kinds of IDS systems are availablefor serving in the network distributed system, but thesesystems mainly concentrate on network-based and host-based detection. It is inconvenient to integrate these sys-tems into distributed application servers for application-based intrusion detection. An agent-based IDS that canbe smoothly integrated into the applications of enterpriseinformation systems is proposed in this paper and we dis-cuss the system architecture, agent structure, and integra-tion mechanism. Our IDS system consists of three kindsof agents, namely, client agent, server agent and commu-nication agent. This paper also explains how to integrateagents with an access control model for getting better se-curity performance. By introducing standard protocolssuch as KQML, IDMEF into the design of agent, ouragent-based IDS shows how to build more °exible soft-ware applications. Keywords: Agent-based, IDMEF, intrusion detection,KQML 1 Introduction Many application services, such as e-business, remote ed-ucation and Internet-based design, etc, are necessary tobe distributed over the Internet. However, because theInternet is an open society so that anyone can access theresource on it, then the application system may confrontwith all kinds of attacks or intrusions, such as Denial ofService (DoS), port scan, illegal intrusion by hacking userinformation, etc.Of all these security events, illegal intrusion is a moreserious issue. But standard security deployments such asﬂrewalls are limited in their eﬁectiveness because of sim-ple access control mode and also the intrusion methodsare evolving fast. Once an attacker has breached the ﬂre-wall, he can roam at will through the network [13]. Thismakes intrusion detection system (IDS) very importantand necessary. Traditionally, there are two main classesof IDSs: host-based and network-based systems. A host-based IDS monitors the detailed activity of a particularhost, while network-based IDS monitors networks of com-puters and other devices such as, routers, gateways, andprimarily detects intrusion by sni–ng and analyzing datafrom network tra–c. Network and host-based IDSs, canbe further classiﬂed based on two methods of detection[17]: anomaly detection and misuse detection.However, Masquerading attack is a typical intrusionand it can be a more serious threat to the security ofcomputer systems and the computational infrastructure[15]. By this kind of attacks, an assailant attempts toimpersonate a legitimate user after gaining access to thislegitimate user’s account. So, the assailant can fully un-derstand the information he gets. While by other kinds ofattacks, he just gets some segment of data or encrypteddata, which is much more di–cult to be understood. Awell-known instance of masquerader activity is about aFBI mode [15]. Since masquerading attack happens ex-actly at application layer, we call the methods to detectthis kind intrusion as application-based intrusion detec-tion. Application-based intrusion is more di–cult to bedetected and the detection program is usually unable toget satisfactory performance for the following reasons:1) Data about user action on system is much more di–-cult to be collected than network-based or host-baseddetection, because of the independency of applicationsystem.2) Application-based detection can degrade the perfor-mance of corresponding application system due tothe extra work that should be done in the process ofdata collection and analysis.3) A masquerader may happen to have similar behav-ioral patterns as the legitimate user, therefore it canescape detection and successfully cause damage un-der the cover of seemingly normal behavior [4].

An integrated pattern recognition approach for intrusion detection

Multi-agent based hybrid Intrusion detection system

An Intrusion Detection System Based On System Call

Dynamical System approach to insider threat detection

Intrusion detection techniques and approaches

An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks

An innovative model for an enhanced dual intrusion detection system using LZ‐JC‐DBSCAN, EPRC‐RPOA and EG‐GELU‐GRU

An Artificial Intelligence-based, Big Data-aware, Long-lasting Security Solution for the Internet of Things

Intrusion Detection System - Deep Learning Perspective

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

Agent-based Intrusion Detection for Network-based Application.

Research and implementation on snort-based hybrid intrusion detection system

A hybrid intrusion detection system design for computer network security

Performance evaluation of Machine learning algorithms for Intrusion Detection System

Intelligent Detection System framework using Mobile agents

Agent-Based Intrusion Detection System for Integration.

Generative AI and Cognitive Computing-Driven Intrusion Detection System in Industrial CPS

Intrusion Detection System for Autonomous Vehicles Using Non-Tree Based Machine Learning Algorithms

A Digest and Pattern Matching-Based Intrusion Detection Engine

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection