Sciweavers

CIA
2007
Springer

High-Performance Agent System for Intrusion Detection in Backbone Networks

13 years 9 months ago
High-Performance Agent System for Intrusion Detection in Backbone Networks
Abstract. This paper presents a design of high-performance agentbased intrusion detection system designed for deployment on high-speed network links. To match the speed requirements, wire-speed data acquisition layer is based on hardware-accelerated NetFlow like probe, which provides overview of current network traffic. The data is then processed by detection agents that use heterogenous anomaly detection methods. These methods are correlated by means of trust and reputation models, and the conclusions regarding the maliciousness of individual network flows is presented to the operator via one or more analysis agents, that automatically gather supplementary information about the potentially malicious traffic from remote data sources such as DNS, whois or router configurations. Presented system is designed to help the network operators efficiently identify malicious flows by automating most of the surveillance process.
Martin Rehák, Michal Pechoucek, Pavel Celed
Added 07 Jun 2010
Updated 07 Jun 2010
Type Conference
Year 2007
Where CIA
Authors Martin Rehák, Michal Pechoucek, Pavel Celeda, Vojtech Krmicek, Jirí Moninec, Tomás Dymácek, David Medvigy
Comments (0)