Design and management of collaborative intrusion detection networks

Traditional intrusion detection systems (IDSs) work in isolation and are not effective to detect unknown threats. An intrusion detection network (IDN) is a collaborative IDS network intended to overcome this weakness by allowing IDS peers to share detection knowledge and experience, and hence improve the overall accuracy of intrusion assessment. However, malicious insiders and free riders may compromise the efficiency of IDNs. In this work, we design a collaborative IDN system and particularly focus on four research problems, namely, trust management, collaborative intrusion decision, resource management, and collaborators selection. We evaluate our design in terms of several desired properties such as efficiency, robustness, scalability and incentive-compatibility.