Abstract:Recently, network security has become an extremely vital issue that beckons the development of accurate and efficient solutions capable of effectively defending our network systems and the valuable information journeying through them. In this article, a distributed multiagent intrusion detection system (IDS) architecture is proposed, which attempts to provide an accurate and lightweight solution to network intrusion detection by tackling issues associated with the design of a distributed multiagent system, such as poor system scalability and the requirements of excessive processing power and memory storage. The proposed IDS architecture consists of (i) the Host layer with lightweight host agents that perform anomaly detection in network connections to their respective hosts, and (ii) the Classification layer whose main functions are to perform misuse detection for the host agents, detect distributed attacks, and disseminate network security status information to the whole network. The intrusion detection task is achieved through the employment of the lightweight Adaptive Sub-Eigenspace Modeling (ASEM)-based anomaly and misuse detection schemes. Promising experimental results indicate that ASEM-based schemes outperform the KNN and LOF algorithms, with high detection rates and low false alarm rates in the anomaly detection task, and outperform several well-known supervised classification methods such as C4.5 Decision Tree, SVM, NN, KNN, Logistic, and Decision Table (DT) in the misuse detection task. To assess the performance in a real-world scenario, the Relative Assumption Model, feature extraction techniques, and common network attack generation tools are employed to generate normal and anomalous traffic in a private LAN testbed. Furthermore, the scalability performance of the proposed IDS architecture is investigated through the simulation of the proposed agent communication scheme, and satisfactory linear relationships for both degradation of system response time and agent communication generated network traffic overhead are achieved.

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Multi-agent based hybrid Intrusion detection system

Hybrid Intrusion Detection System for Complicated Network

Securing Cluster-heads in Wireless Sensor Networks by a Hybrid Intrusion Detection System Based on Data Mining

A Hybrid Intrusion Detection System for IoT Applications with Constrained Resources

On the Deployment Strategy of Distributed Network Security Sensors

Compressed Sensing Based Intrusion Detection System for Hybrid Wireless Mesh Networks

Network intrusion detection through Adaptive Sub-Eigenspace Modeling in multiagent systems

The Research of Frame and Key Technologies for Intrusion Detection System in IEEE 802.11-based Wireless Mesh Networks

A dynamically self-adaptive intrusion detection architecture for mobile ad hoc networks

Novel hybrid intrusion detection system for clustered wireless sensor network

Evaluation of Network Based IDS and Deployment of multi-sensor IDS

Research of the Key Technologies for the Intrusion Detection System in Wireless Mesh Networks

Fuzzy optimization for security sensors deployment in collaborative intrusion detection system

A Hierachical Intrusion Detection System Based on Distributed Autonomous Agents

Enhancing Cybersecurity in Cloud Computing and WSNs: A Hybrid IDS Approach

Detection Resource Allocation Scheme for Two-Layer Cooperative IDSs in Smart Grids.

Optimization assisted deep learning based intrusion detection system in wireless sensor network with two‐tier trust evaluation

Multilayer Intrusion Detection System Based on Semi-supervised Clustering

An Intrusion Detection System Based on MANET

A Dynamic Cooperative Monitor Node Selection Algorithm In Wireless Mesh Networks