Attacks on information systems followed by intrusions may cause large revenue losses. The prevention of both is not always possible by just considering information from isolated sources of the network. A global view of the whole system is necessary to recognize and react to the different actions of such an attack. The design and deployment of a decentralized system targeted at detecting as well as reacting to information system attacks might benefit from the loose coupling realized by publish subscribe middleware. In this paper, we present the advantages and convenience in using this communication paradigm for a general decentralized attack prevention framework. Furthermore, we present the design and implementation of our approach based on existing publish subscribe middleware and evaluate our approach for GNU Linux systems.
The AAfID (Architecture for Intrusion Detection using Autonomous Agents) also pre -sents a hierarchical approach to remove the limitations of centralized approaches and, particularly, to provide better resistance to denial of service attacks @cite_9 . It consists of four main components called agents, filters, transceivers, and monitors organized in a tree structure, where child and parent components communicate with each other. The communication subsystem of AAfID exhibits a very simplistic design and does not seem to be resistant to a denial of service attack as intended. Although the set of agents may communicate with each other to agree upon a common suspicion level regarding every host, all relevant data is simply forwarded to monitors via transceivers and demands for human interaction in order to detect distributed intrusions.
@cite_9
2124365372 2542991636 2792169732 2121464912
AAFID is a distributed intrusion detection architecture and system, developed in CERIAS at Purdue University. AAFID was the first architecture that proposed the use of autonomous agents for doing intrusion detection. With its prototype implementation, it constitutes a useful framework for the research and testing of intrusion detection algorithms and mechanisms. We describe the AAFID architecture and the existing prototype, as well as some design and implementation experiences and future research issues. ” 2000 Elsevier Science B.V. All rights reserved. In this paper, we propose a hierarchical monitoring intrusion detection system (HAMIDS) for industrial control systems (ICS). The HAMIDS framework detects the anomalies in both level 0 and level 1 of an industrial control plant. In addition, the framework aggregates the cyber-physical process data in one point for further analysis as part of the intrusion detection process. The novelty of this framework is its ability to detect anomalies that have a distributed impact on the cyber-physical process. The performance of the proposed framework evaluated as part of SWaT security showdown (S3) in which six international teams were invited to test the framework in a real industrial control system. The proposed framework outperformed other proposed academic IDS in term of detection of ICS threats during the S3 event, which was held from July 25-29, 2016 at Singapore University of Technology and Design. In this paper, online detection of false data injection attacks and denial of service attacks in the smart grid is studied. The system is modeled as a discrete-time linear dynamic system and state estimation is performed using the Kalman filter. The generalized cumulative sum algorithm is employed for quickest detection of the cyber-attacks. Detectors are proposed in both centralized and distributed settings. The proposed detectors are robust to time-varying states, attacks, and set of attacked meters. Online estimates of the unknown attack variables are provided, that can be crucial for a quick system recovery. In the distributed setting, due to bandwidth constraints, local centers can only transmit quantized messages to the global center, and a novel event-based sampling scheme called level-crossing sampling with hysteresis is proposed that is shown to exhibit significant advantages compared with the conventional uniform-in-time sampling scheme. Moreover, a distributed dynamic state estimator is proposed based on information filters. Numerical examples illustrate the fast and accurate response of the proposed detectors in detecting both structured and random attacks and their advantages over existing methods. This paper presents a hierarchical control architecture that enables cooperative surveillance by a heterogeneous aerial robot network comprised of mothership unmanned aircraft and daughtership micro air vehicles. Combining the endurance, range, and processing capabilities of the motherships with the stealth, flexibility, and maneuverability of swarms of daughterships enables robust control of aerial robot networks conducting collaborative operations. The hierarchical control structure decomposes the system into components that take advantage of the abilities of the different types of vehicles. The motherships act as distributed databases, fusion centers, negotiation agents, and task supervisors while daughtership control is achieved using cooperative vector field tracking. This paper describes the overall architecture and then focuses on the assignment and tracking algorithms used once sub- teams of daughtership vehicles have been deployed. A summary of the communication, command, and control structure of a heterogeneous unmanned aircraft system is also given in this paper along with hardware-in-the-loop and software simulation results verifying several components of the distributed control architecture.