Secure and Efficient Rule Sharing for Collaborative Intrusion Detection: Leveraging CP-ABE and Blockchain Technology
Hong Ji Chen, Bo-Chao Cheng · 2024
An intrusion detection system (IDS) is a software program that identifies malicious activity or policy violations in order to improve cybersecurity. A single and solitary IDS suffers from a single point of failure and lacks complete network information about potential threats in order to provide accurate detection and offer a more comprehensive picture of the whole network. The concept that several intrusion detection systems (IDSs) may cooperate and exchange data to improve overall detection accuracy and efficiency is known in technology as Collaborative Intrusion Detection Networks (CIDN). Secure information sharing in CIDN is critical since sharing IDS parties must trust one another and guarantee that no information is exposed to other parties. This article proposes the Blockchain-based Rule Sharing Mechanism (BRSM), a trustworthy and efficient information dissemination mechanism that integrates Blockchain technology with Ciphertext Policy Attribute-based Encryption (CP-ABE). When exchanging data across IDS nodes, the publish IDS node employs CP-ABE to encrypt shared data (such as detection rules and alerts) before putting it on the Blockchain via smart contracts. According to the experiment results, BRSM performs better than other cutting-edge techniques now in use to maintain utility and privacy in CIDN rule sharing.