A Peer-to-Peer Collaborative Intrusion Detection System
Shanika Karunasekera Chenfeng Vincent Zhou · 2006
Many types of network intrusions occur in multiple networks simultaneously, for example, scanning, worms, and denial-of-service attacks. Most of the current intrusion detection systems work in isolation to detect these attacks. Past research has shown that collaboration between these networks to share suspicious information is an effective way to detect intrusion. However, there are some challenges associated with the idea of collaborative detection, such as scalability and avoidance of a central point of failure. We propose a peer-to-peer approach for collaborative intrusion detection to address these challenges. Our solution proposes secure data sharing between participants from different organizations using a content based peer-to-peer publish/subscribe mechanism. The proposed scheme improves scalability, while avoiding a central point of failure. Our experimental results show improved detection latency and effective load balancing compared to a centralized architecture.