Multiagent approach to network traffic anomalies uncertainty level assessment in distributed intrusion detection system

Abstract

The paper proposes a formal framework for network traffic anomalies uncertainty level assessment within a distributed multiagent Intusion Detection System (IDS) architecture. The role of traffic anomalies detection is discussed then it has been clarified how some specific values characterizing network communication can be used to detect network anomalies caused by security incidents (worm attack, virus spreading). Finally, it has been defined how to use the proposed techniques in distributed IDS. © Springer-Verlag Berlin Heidelberg 2007.