A method of tracing intruders by use of mobile agents
Midori Asaka · 1999
. A network intrusion detection system (IDA) retrieves information related to intrusions from target systems across the network by using mobile agents. Simultaneously, the agents trace the intruders. IDA detects intrusions based on information collected and the route of intrusion. This paper mainly describes how IDA retrieves the information and traces the intrusions. 1 Introduction Computer break-ins are mainly divided into two types; break-ins from outside LAN and those from inside LAN. However, it is rare in either case that intruders directly attack the target host from their own hosts[1]. The reason for this is logical; intruders desire to conceal their origin. Intruders tend to attack the less protected hosts first, gradually approaching hosts armed with stronger protection, ultimately working up to and reaching their target hosts. Commonly, administrators not only on the target hosts but also on the intermediate hosts do not notice the intrusion. Furthermore, the adminis...