Sept. 4, 2006 to Sept. 8, 2006
Claudiu Duma , Linkopings Universitet, Sweden
Martin Karresand , Swedish Defense Research Agency, Sweden
Nahid Shahmehri , Linkopings Universitet, Sweden
Germano Caronni , Sun Microsystems Laboratories, USA
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/DEXA.2006.21
Collaborative intrusion detection systems (IDSs) have a great potential for addressing the challenges posed by the increasing aggressiveness of current Internet attacks. However, one of the major concerns with the proposed collaborative IDSs is their vulnerability to the insider threat. Malicious intruders, infiltrating such a system, could poison the collaborative detectors with false alarms, disrupting the intrusion detection functionality and placing at risk the whole system. In this paper, we propose a P2P-based overlay for intrusion detection (Overlay IDS) that addresses the insider threat by means of a trust-aware engine for correlating alerts and an adaptive scheme for managing trust. We have implemented our system using JXTA framework and we have evaluated its effectiveness for preventing the spread of a real Internet worm over an emulated network. The evaluation results show that our Overlay IDS significantly increases the overall survival rate of the network.
Claudiu Duma, Martin Karresand, Nahid Shahmehri, Germano Caronni, "A Trust-Aware, P2P-Based Overlay for Intrusion Detection", DEXA, 2006, 2012 23rd International Workshop on Database and Expert Systems Applications, 2012 23rd International Workshop on Database and Expert Systems Applications 2006, pp. 692-697, doi:10.1109/DEXA.2006.21