Abstract:Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

A Regular Expression Matching Approach to Distributed Wireless Network Security System.

Research of Distributed Pre-Decision Engine in Wireless Intrusion Prevention Systems

Intrusion Detection And Simulation For High-Speed Networks

A Survey on Regular Expression Matching for Deep Packet Inspection: Applications, Algorithms, and Hardware Platforms

A Multiple Regular Expressions Matching Architecture For Network Intrusion Detection System

Based on Regular Expression Matching of Evaluation of the Task Performance in WSN: a Queue Theory Approach.

A Synergetic Pattern Matching Method Based-On Dht Structure For Intrusion Detection In Large-Scale Network

Hes: Highly Efficient And Scalable Technique For Matching Regex Patterns

A Novel Hybrid Architecture for High Speed Regular Expression Matching.

Distributed Classification of Localization Attacks in Sensor Networks Using Exchange-Based Feature Extraction and Classifier

Variable Length Pattern Matching for Hardware Network Intrusion Detection System

Research and Implementation of Network Active Defense and Pattern Matching Algorithm

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

High Camouflage Intrusion Detection Method for Structured Database Based on Multi Pattern Matching

Extraction of Fingerprint from Regular Expression for Efficient Prefiltering

Study on Pattern Matching in Network Security

Efficient Regular Expression Matching over Compressed Traffic

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

Generating regular expression signatures for network traffic classification in trusted network management

Optimization of Network Security Intelligent Early Warning System Based on Image Matching Technology of Partial Differential Equation.

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection