Case-Based Agents for Packet-Level Intrusion Detection in Ad Hoc Networks

In this paper we propose a distributed agent framework for an intrusion detection system aimed at ad hoc wireless networks. Wireless networks are particularly vulnerable to intrusion, as they operate in an open medium, and use cooperative strategies for network communications. By efficiently merging audit data from multiple security agents, we analyze the entire ad hoc wireless network for intrusions and try to inhibit intrusion attempts. A case-based reasoning approach to our intrusion detection engine provides a framework incorporating sophisticated artificial intelligence techniques that help overcome some of the limitations of other rule-based intrusion detection systems. In contrast to many existing intrusion detection systems, we design and implement an efficient, bandwidth-conscious framework that targets intrusion at multiple levels and takes into account the distributed nature of ad hoc wireless network management and decision policies.