An Enhanced Infrastructure for Peer-to-Peer Intrusion Detection Systems

Peer-to-peer (P2P) overlays are employed as the underlying infrastructure of P2P intrusion detection systems (IDSs). However, the improper topology of this type of infrastructure prevents efficient propagation of alerts among IDS peers and hence quick detection. We propose an enhanced logical topology as the infrastructure of P2P IDSs. We demonstrate that using this method reduces the communication latency of P2P IDSs significantly. Therefore, the enhanced infrastructure can be integrated with the existing peer-to-peer IDS architectures to further improve their performance. Our evaluation results show the performance of the existing P2P IDSs can be improved around 70% in large scale environments.