Collaborative intrusion detection system

Abstract

This paper presents an intrusion detection system consisting of multiple intelligent agents. Each agent uses a self-organizing map (SOM) in order to detect intrusive activities on a computer network. A blackboard mechanism is used for the aggregation of results generated from such agents (i.e. a group decision). In addition, this system is capable of reinforcement learning with the reinforcement signal generated within the blackboard and then distributed over all agents which are involved in the group decision making. Systems with various configurations of agents are evaluated for criteria such as speed, accuracy, and consistency. The results indicate an increase in classification accuracy as well as in its constancy as more sensors are incorporated. Currently this system is primarily tested on the data set for KDD Cup '99.