Flexible, Mobile Agent Based Intrusion Detection for Dynamic Networks
Christopher Krügel, Thomas A. Toth · 2001
Intrusion detection systems (IDS) are security tools that attempt to detect malicious activities which are targeted against a network and its resources. Similar to virus scanners, IDS sensors need regular updates of their attack databases to detect novel intrusion attempts. Additionally, the identification of distributed intrusions requires cooperation of different sensors. Mobile devices present a new challenge to intrusion detection. Whenever such a machine (e.g. laptop) is plugged into the network, it introduces a potential entry point that might be exploited by hackers. Ideally, the newly inserted device immediately participates in the intrusion detection process. This would require an instant integration into the detection process and an automatic update of the attack database. Such requirements are not addressed by current ID systems that assume a static environment. We present Sparta, a mobile agent based ID system that allows to detect network intrusions in a changing, dynamic environment. Each participating device only requires an agent platform as well as generic sensor support. When connected to the network it becomes automatically and smoothly integrated into the ID process.