Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

In very many situations the collection of data from distributed hosts for its subsequent use to generate an intrusion detection profile may not be technically feasible (e.g., due to data size or network security transfer protocols). This situation is especially evident for data intensive intrusion profile generation (e.g., inducing profiles via data mining techniques). An alternative solution is to build a network profile by applying distributed data analysis methods (e.g., agent based computing). Such an approach is described in this paper. Global profiles are built using a Distributed Data Mining approach that integrates inductive generalization and Agent based computing. In this approach, classification rules are learned via tree induction from distributed data to be used as intrusion profiles. Agents, in a collaborative fashion, generate partial trees and communicate the temporary results among them in the form of indices to the data records. The process is terminated when a final tree is induced. This communication mechanism does not involve any data transfers, and in addition, a compression approach is used to reduce the communication bandwidth of data index transfers.

REFERENCES

• 1: Hudjarian, Ali Baik, Sung Bala, Jerzy; InferAgent - A Decision Tree Induction From Distributed Data Algorithm; Proceedings of the 5th World Multi-Conference on Systemics, Cybernetics and Informatics, Orlando, FL July, 2001.
• 2: Ingram, H. Kremerm, Steven Rowe, Neil C., Distributed Intrusion Detection for Computer Systems Using Communicating Agents, Proceedings of the 2000 Command and Control Research and Technology Symposium, Monterey, CA, June 2000.
• 3: Sandeep Kumar, Classification and detection of computer intrusions, Purdue University, West Lafayette, IN, 1996
• 4: Lee, Wenke Stolfo, Salvatore J., Data Mining Approaches for Intrusion Detection, Proceedings of the 7th USENIX Security Symposium, San Antonio, TX, January 1998.
• 5: Peter G. Neumann , Phillip A. Porras, Experience with EMERALD to Date, Proceedings of the Workshop on Intrusion Detection and Network Monitoring, p.73-80, April 09-12, 1999
• 6: Sobirey, Michael Richter, Birk, The Intrusion Detection System AID, Brandenburg University of Technology at Cottbus, On-line at http://www-rnks.informatik.tu-cottbus.de/~sobirey/aid.e.html.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.m Miscellaneous

General Terms:
Management

Keywords:
agent computing, distributed data mining, intrusion detection