17th International Workshop on Database and Expert Systems Applications (DEXA'06) (2006)
Sept. 4, 2006 to Sept. 8, 2006
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/DEXA.2006.21
Claudiu Duma , Linkopings Universitet, Sweden
Martin Karresand , Swedish Defense Research Agency, Sweden
Nahid Shahmehri , Linkopings Universitet, Sweden
Germano Caronni , Sun Microsystems Laboratories, USA
Collaborative intrusion detection systems (IDSs) have a great potential for addressing the challenges posed by the increasing aggressiveness of current Internet attacks. However, one of the major concerns with the proposed collaborative IDSs is their vulnerability to the insider threat. Malicious intruders, infiltrating such a system, could poison the collaborative detectors with false alarms, disrupting the intrusion detection functionality and placing at risk the whole system. In this paper, we propose a P2P-based overlay for intrusion detection (Overlay IDS) that addresses the insider threat by means of a trust-aware engine for correlating alerts and an adaptive scheme for managing trust. We have implemented our system using JXTA framework and we have evaluated its effectiveness for preventing the spread of a real Internet worm over an emulated network. The evaluation results show that our Overlay IDS significantly increases the overall survival rate of the network.
M. Karresand, N. Shahmehri, G. Caronni and C. Duma, "A Trust-Aware, P2P-Based Overlay for Intrusion Detection," 17th International Workshop on Database and Expert Systems Applications (DEXA'06)(DEXA), Krakow, Poland, 2006, pp. 692-697.