Multi-agent Peer-to-Peer Intrusion Detection

Ever increasing use of heterogeneous networks including mobile devices and ad-hoc sensor networks signifies the role of such information system properties as openness, autonomy, cooperation, coordination, etc. Agent-based service-oriented Peer-to-Peer (P2P) architecture provides attractive (if not single) design and implementation paradigm for such systems. This trend implies coherent evolution of security systems, what put in use the notions of distributed security policy, distributed intrusion detection systems, etc.1, requiring novel ideas. The paper proposes new architecture for such security systems. This architecture provides cooperative performance of distributed security means (agents) supported by distributed meta-knowledge base implemented as an overlay network of instances of P2P agent platform set up on top of P2P networking provider. The paper also analyzes new issues of P2P security systems with the main attention to P2P training of security agents to correlation of alerts produced by other relevant agents. An artificially built case study is used to highlight the essence of P2P security agent training to P2P decision combining and to exhibit new problems.