doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Multi-Agent systems <s> The attackers on Internet-connected systems we are seeing today are more serious and technically complex than those in the past. So it is beyond the scope of any one system to deal with the intrusions. This paper shows a modeling and simulation of network security in which the multiple IDSes (Intrusion Detection System) and a firewall coordinate by sharing attacker's information for the effective detection of the intrusion. Another characteristic in the proposed simulation is the composition of a real intrusion by generating nonabstracted intrusion packets and, accordingly, the construction of nonabstracted version of IDS and firewall model components. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> The use of Multi-Agent systems <s> We propose a distributed approach to detect distributed denial of service attacks by monitoring the increase of new IP addresses. Unlike previous proposals for bandwidth attack detection schemes which are based on monitoring the traffic volume, our scheme is very effective for highly distributed denial of service attacks. Our scheme exploits an inherent feature of DDoS attacks, which makes it hard for the attacker to counter this detection scheme by changing their attack signature. Our scheme uses a sequential nonparametric change point detection method to improve the detection accuracy without requiring a detailed model of normal and attack traffic. In a multi-agent scenario, we show that by sharing the distributed beliefs, we can improve the detection efficiency. <s> BIB002
Another important direction of DoS detection research is distributed detection in a multi-agent framework. Such an example is the Source IP monitoring scheme BIB002 , where new legitimate source IP addresses appearing in the traffic are collected in an IP Address Database during the off-line training phase. The database is used together with data gathered from the incoming traffic to decide about possible DoS attacks in the detection and learning phases. The CUSUM method is used to extract information about the change in the number of new IP addresses, yielding a variable that represents the change and a local threshold for each agent. All agents apply this scheme and if any of them suspects an attack, it broadcasts this information to the other agents. Since the selection of the broadcast threshold is important, a gradient-based learning technique is used to select an optimal value that minimises both the communication overhead and the confirmation delay. More multiagent approaches can be found in  , which uses concepts from the biological immune systems and in BIB001 , which employs a Black Board Architecture and a firewall to detect DoS attacks and to form a black list of IP addresses. In general, the multi-agent approaches are more accurate at detecting highly distributed DoS attacks, but are inevitably slower compared to a centralised system simply because of the delay that inter-agent communication introduces. conditions. Comparisons become very difficult when one considers that there is a significant variation even in the types of attacks that the different detection schemes are trying to address. Thus, with the vast differences in the experimental setups and simulation datasets that researchers have used, we feel that an evaluation and accuracy comparison of the numerous contributions included in this survey is likely to be very difficult, but is worth pursuing. Furthermore, some of the studies we have surveyed concentrate solely on detection of DoS, while there has been a significant amount of work on extending intrusion detection techniques to DoS and developing general detection systems to work for any kind of attack including DoS. However, the fact that DoS attacks use traffic that in isolation is harmless and becomes harmful when concentrated against a target, differentiates them from other types of network security attacks.