IDReAM: Intrusion Detection and Response Executed with Agent Mobility

Abstract

Nowadays, lots of researches in Intrusion Detection and Intrusion Response try to find new solutions to circumvent new intrusive behaviors. One of the principal weaknesses of these systems is the lack of robustness inherent in their centralized nature. Even though most of the existing Intrusion Detection and Response Systems (IDRSystems) use distributed data collection (host-based or network-based) many of them continue to perform data analysis centrally, thereby limiting scalability. Moreover, even if the IDRSystem is distributed in the network, its deployed elements generally remain static. With the means available to modern attackers, such as automated intrusion tools, these static and distributed elements are easily accessible. Often, this does not always contribute to improving the reliability and resistance to attacks of such static components.

This paper presents our approach for building an IDRSystem called Intrusion Detection and Response extended with Agent Mobility or IDReAM for short. IDReAM combines Mobile Agents (MAs) with self-organizing paradigms inspired by natural life systems. This approach was already announced in a preceding paper [4], and the present paper describes in a more detailed way the conceptual model. All the research works relating to IDReAM are gathered in a PhD Thesis [3] which also contains the implementation results of the model and its evaluation. The present paper is limited only to the model.