Abstract
Recently, numerous studies have focused on multi-agentbased intrusion detection systems (IDSs) in order to detect intrusion behavior more efficiently. However, since an agent is easily subverted by a process that is faulty, a multi-agent based intrusion detection system must be fault tolerant by being able to recover from system crashes, caused either accidentally or by malicious activity. Many of the existing IDSs have no means of providing such failure recovery. In this paper, we propose the novel intrusion-tolerant IDS using communication-induced checkpointing and pessimistic message logging techniques. When the failed agent is restarted, therefore, our proposed system can recover its previous state and resume its operation unaffected. In addition, agents communicate with each other by sending messages without causality violation using vector timestamps.
This work was supported by grant No. R01-2002-000-00235-0 from the Basic Research Program of the Korea Science & Engineering Foundation
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Denning, D.E.: An intrusion-dection model. In: Proceeding of Symposium on Security and Privacy, pp. 118–131 (1986)
Crosbie, E., Spafford, E.H.: Active defense of computer system using autonomous agents. Technical report, COAST Group, Purdue University (1995)
Elnozahy, E.N., Johnson, D.B., Wang, Y.M.: A survey of rollbalck-tecovery protocols in message passing systems. CMU Technical Report CMU-CS-99-148 (1999)
Balasubramaniyan, J.S., Farcia-Fernandez, J.O., Isacoff, D., Spafford, E., Zamboni, D.: An architecture for intrusion detection using autonomous agents. Technical report, COAST Laboratory, Purdue University (1998)
Myung-Kyu, Y., Chong-Sun, H.: Design of fault tolerant architecture for intrusion detection system using autonomous agents. In: Proceedings of the International Conference on Information Networking (2003)
Myung-Kyu, Y., Maeng-Soon, B., Chong-Sunm, H.: Design of fault tolerant mechanism for multi-agent based intrusion detection system. In: Proceedings of the International Conference on Security and Management (2003)
Ran, Z., Depei, Q., Chongming, B., Weiguo, W., Xiaobing, G.: Multiagent based intrusion detection architecture. In: Proceedings of the International Conference on Computer Networks and Mobile Computing, pp. 494–501 (2001)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yi, MK., Hwang, CS. (2004). Intrusion-Tolerant Intrusion Detection System. In: Chen, H., Moore, R., Zeng, D.D., Leavitt, J. (eds) Intelligence and Security Informatics. ISI 2004. Lecture Notes in Computer Science, vol 3073. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-25952-7_38
Download citation
DOI: https://doi.org/10.1007/978-3-540-25952-7_38
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-22125-8
Online ISBN: 978-3-540-25952-7
eBook Packages: Springer Book Archive