A Super-Peer Approach for Scalable Collaborative Intrusion Detection Network (CIDN) - Bakhdlaghi, Yousef; Izura Udzir, Nur; Abdullah, Azizol; Fazlida Mohd Sani, Nor (International Journal of Engineering and Technology, 2018)
Collaborative intrusion detection systems (CIDSs) have the ability to correlate suspicious activities from various CIDSs in different networks to maximize the efficiency of the intrusion detection in addition to sharing the knowledge and resources among them. Current consultation-based CIDNs do not honor the scope variations of CIDSs (area of expertise). Evaluating collaboratorsâ€™ knowledge regardless of their scope variations could degrade the efficiency of the CIDN, while in reality CIDSs have different platforms and strengths in various areas that could affect the overall scalability and efficiency of the architecture negatively. Additionally, many architectures in the literature built under information-based settings, while few architectures have the consultation-based capabilities. An architecture that combines both information-based and consultation-based capabilities has not been proposed yet. This paper proposes a scope-aware super-peer collaborative intrusion detection network (CIDN) architecture that takes CIDS scope into consideration when consulting, by organizing CIDSs into groups based on their scope regardless of their physical locations as well as incorporating the information-based into the consultation-based architecture to benefit from consultation-based capabilities while limiting the information being distributed to fast-spreading attacks that are discovered from consultation requests. However, the proposed architecture can strengthen the efficiency of the CIDN as well as reducing the overload of the communications among collaborators and contributes to enhance the overall scalability of the architecture.Â Â
Keywords: Collaborative intrusion detection network; Intrusion detection; Network security; Scalable CIDN; Super-peer architecture.