A MultiAgent Approach for Hybrid Intrusion Detection in Industrial Networks: Design and Implementation The integration of Network Intrusion Detection Systems (Network IDS) in industrial networks has improved the security of these systems due to their ability to analyze network traffic in order to detect potential system intrusions. Unfortunately, their detection scope is often limited to strategical network locations and may therefore not be capable to detect intrusions occurring at other system locations (e.g., specific devices). Hence, it is necessary to increase their detection scope by further analyzing additional information pertaining to other system components. The introduction of these new information sources adds more complexity to the intrusion detection problem, as it is not only necessary to identify them, but it is also required to define how their authentication, capture and analysis is to be carried out. MultiAgent Systems are an architectural paradigm that can deal with such complexity. This paper presents a multiagent approach for hybrid intrusion detection that takes into consideration the aforementioned challenges. This approach is comprised of a multiagent hybrid intrusion detection architecture designed according to a set of properties. These properties consider IDSspecific requirements. It also takes into consideration current trends in the field of MultiAgent Systems to provide security, scalability and adaptability across multiple systems. The feasibility of this approach is validated through a prototypical implementation.

A Novel Immune Detection Approach Enhanced by Attack Graph Based Correlation Artificial immune systems (AIS) are computational intelligence inspired by the human biological immune system. The AIS four main algorithms are negative selection, clonal selection, immune network, and danger theory. This paper incorporates the AIS approach to develop an agentbased detection method to analyze network traffic. The system works with an attack graph based correlation technique. This technique can improve detection performance by decreasing false alerts. This work was tested for denial of service (DoS), remote to local (R2L), user to root (U2R) and probe attack classes. Results have shown the addition of the correlation technique can aid to the detection performance of AIS detection systems.