This paper focuses on intrusion detection and countermeasures with respect to widely-used operating systems and networks. The design and architecture of an intrusion detection system built from distributed agents is proposed to implement an intelligent. system on which data mining can be performed to provide global, temporal views of an entire networked system. A starting point for agent intelligence in our system is the research into the use of machine learning over system call traces from the privileged sendmail program on U". We use a rule learning algorithm to classify the system call traces for intrusion detection purposes and show the results. Our experience in managing networks of computer systems with known vulnerabilities has resulted in the investigation of the problem of detecting misuse of computer systems [4]. Because of the effort required to monitor systems and networks manually, we could not easily detect either attempts at misuse or successful attacks without the help of intelligent intrusion detection systems. We propose an artificially intelligent system for intrusion detection and countermeasures on computer systems in a network environment using data mining technology. The system would be built using distributed intelligent agents to apply a data mining approach to intrusion detection. Data gathering agents will render system logs and activity data into common formats while low-level agents classify recent activities and provide data and current classification states to each other and to a higher level of agents that implement data mining over the entire knowledge and data sources of the system. Projects related to our intrusion detection project include DIDS, Computer Immunology, JAM, and EMERALD. The Distributed Intrusion Detection System (DIDS) [SI uses a combination of host monitors and local area network monitors to monitor system & network activities with a centralized director aggregating information from the monitors to detect intrusions. It is similar to our agent system for intrusion detection and countermeasures in that it uses multiple monitors and artificial intelligence algorithms to determine the severity of events. DIDS differs from our system in that the intelligence is purely centralized, and it does not make use of any agent technology. The Computer Immunology project [6] explored designs of intrusion detection systems that can effectively detect and defend intrusions in a networked computer system in a manner similar to the immune system in animals. One portion of the project [5] researched a method that could provide a component of an immune system for computers. They developed a sense of "self" for privileged programs by creating a database of normal and abnormal system call traces for instances of execution of the programs. The Java Agents for Meta-Learning (JAM) Project [ 1 13 is the most similar to our proposed agent system for intrusion detection and countermeasures in that it used intelligent, distributed Java agents to learn models of fraud and intrusive behavior. The knowledge learned by the distributed Java agents can be exchanged and used to help train other agents that can identify attacks based on the combined knowledge. The JAM project built on the work done by Forrest et. a1 [5] in the area of identifying attacks against privileged programs. A portion of our work derives from this idea of detecting intrusions based on system call traces of privileged programs [7].
Helmer and Wong REF have presented a system that uses lightweight mobile agents for intrusion detection.
Intelligent agents for intrusion detection
1998 IEEE Information Technology Conference, Information Environment for the Future (Cat. No.98EX228)
1998 IEEE Information Technology Conference, Information Environment for the Future (Cat. No.98EX228)
Computer Science