Intrusion detection using autonomous agents
Computer NetworksPublished 1 October 2000
Eugene H. Spafford, Diego Zamboni
Citations348
SJR quartileQ1
SJR score1.17
SNIP1.37
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
The AAFID architecture and the existing prototype, as well as some design and implementation experiences and future research issues are described, which constitute a useful framework for the research and testing of intrusion detection algorithms and mechanisms.
Abstract
AAFID is a distributed intrusion detection architecture and system, developed in CERIAS at Purdue University. AAFID was the first architecture that proposed the use of autonomous agents for doing intrusion detection. With its prototype implementation, it constitutes a useful framework for the research and testing of intrusion detection algorithms and mechanisms. We describe the AAFID architecture and the existing prototype, as well as some design and implementation experiences and future research issues.
Keywords
Computer Science
IEEE NetworkNetwork intrusion detection
1,048 Citations1994Biswanath Mukherjee, L.T. Heberlein +1 more
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
655 Citations1998Thomas H. Ptacek, Timothy N. Newsham
Three classes of attacks which exploit fundamentally problems with the reliability of passive protocol analysis are defined--insertion, evasion and denial of service attacks--and how to apply these three types of attacks to IP and TCP protocol analysis is described.
An architecture for intrusion detection using autonomous agents
471 Citations2002J.S. Balasubramaniyan, J.O. Garcia-Fernandez +3 more
This paper reviews the architecture for a distributed intrusion detection system based on multiple independent entities working collectively, and calls these entities autonomous agents, which solves some of the problems previously mentioned.
The design and implementation of tripwire
450 Citations1994Gene Kim, Eugene H. Spafford
The design and implementation of the Tripwire tool is described, which is tool that aids UNIX system administrators and users in monitoring a designated set of files and directories for any changes, and is highly configurable.
DIDS (distributed intrusion detection system)—motivation, architecture, and an early prototype
394 Citations1997Steven R. Snapp, James Brentano +10 more
An overview of the motivation behind DIDS, the system architecture and capabilities, and a discussion of the early prototype of the DIDS is provided.
A network security monitor
384 Citations1990L.T. Heberlein, Gihan Dias +4 more
Initial results demonstrate that many network attacks are detectable with the authors' monitor, although it can be defeated.
Purdue e-Pubs (Purdue University)Classification and detection of computer intrusions
382 Citations1996Sandeep Kumar
This document summarizes current capabilities, research and operational priorities, and plans for further studies that were established at the 2015 USGS workshop on quantitative hazard assessments of earthquake-triggered landsliding and liquefaction in the western hemisphere.
An introduction to software agents
364 Citations1997Jeffrey M. Bradshaw
The architecture of a network level intrusion detection system
356 Citations1990R. Heady, George F. Luger +2 more
This paper presents the preliminary architecture of a network level intrusion detection system that will monitor base level information in network packets, learning the normal patterns and announcing anomalies as they occur.
IEEE NetworkCooperating security managers: a peer-based intrusion detection system
220 Citations1996Gregory B. White, Eric A. Fisch +1 more
Cooperating security managers (CSM) is designed to perform intrusion detection and reporting functions in a distributed environment without requiring a designated central site or server to perform the analysis of network audit data.
Security for Mobile Agents: Issues and Requirements
197 Citations1996William M. Farmer, Joshua D. Guttman +1 more
This paper investigates new threats from malicious agents and hosts in mobile agent technology and develops a set of achievable security requirements for mobile agent systems.
Computers & SecurityNADIR: An automated system for detecting network intrusion and misuse
161 Citations1993Judy Hochberg, K.A. Jackson +4 more
Analysis by NADIR of two types of ICN activity: user authentication and access control, and mass file storage is described, which highlights system design issues of data handling, exploiting existing auditing systems, and performing audit analysis at the network level.
Purdue e-Pubs (Purdue University System)Defending a Computer System Using Autonomous Agents
152 Citations1995Mark Crosbie, Eugene H. Spafford
This report presents a prototype architecture of a defense mechanism for computer systems where TILcse agents are taught how to recognise intrusive behaviour, and the learning mechanism in the agents is built using Genetic Programming.
Detecting disruptive routers: a distributed network monitoring approach
124 Citations2002Katharine A. Bradley, Steven W. Cheung +3 more
It is argued that WATCHERS' impact on router performance and WATCHers' memory requirements are reasonable for many environments, and it is demonstrated that in ideal conditions WATCHERS makes no false-positive diagnoses.
Purdue e-Pubs (Purdue University)Active Defense of a Computer System using Autonomous Agents
86 Citations1995Mark Crosbie, Eugene H. Spafford
A new architecture is proposed which uses Genetic Programming to evolve programs to detect anomalous behaviour in a system and cooperative monitoring of NFS requests shows how the approach can be generalised.
Purdue e-Pubs (Purdue University System)IDIOT - Users Guide
29 Citations1996Mark Crosbie, Bryn Dole +3 more
This manual gives a detailed technical description of the IDIOT intrusion detection system from the COAST Laboratory at Purdue University and is intended to help anyone who wishes to use, extend or test theIDIOT system.
O'Reilly eBooksPerl module reference
1 Citations1998David Futato
The Kit contains some of the latest commercial Win32 Perl software from Dick Hardt's ActiveState Tool Corporation, along with a collection of Perl modules that run on Win32, and a definitive documentation set from O'Reilly.