Intrusion-tolerant intrusion detection system

Abstract

Recently, numerous studies have focused on multi-agent based intrusion detection systems (IDSs) in order to detect intrusion behavior more efficiently. However, since an agent is easily subverted by a process that is faulty, a multi-agent based intrusion detection system must be fault tolerant by being able to recover from system crashes, caused either accidentally or by malicious activity. Many of the existing IDSs have no means of providing such failure recovery. In this paper, we propose the novel intrusion-tolerant IDS using communication-induced checkpointing and pessimistic message logging techniques. When the failed agent is restarted, therefore, our proposed system can recover its previous state and resume its operation unaffected. In addition, agents communicate with each other by sending messages without causality violation using vector timestamps. © Springer-Verlag Berlin Heidelberg 2004.