Distributed Agent Architecture for Intrusion Detection Based on New Metrics

Current best practices for identifying malicious activity in a network are to deploy network intrusion detection systems. Anomaly detection approaches hold out more promise, as they can detect new types of intrusions because these new intrusions, by assumption, will deviate from ldquonormalrdquo behavior. But these methods generally suffer from several major drawbacks: computing the anomaly model itself is a time-consuming and processor-heavy task. To avoid these limits, we propose a mobile agent based model for intrusion detection system, called MAFIDS, including new metrics issued from emergent indicators of the agent synergy and a proposed event correlation engine. We detail the implementation of our model showing its capabilities to detect the SYN Flooding attack in a short time and lower false alarm rate by comparing it to SNORT.